CVE-2026-72793

SiYuan's POST /api/system/getConf endpoint masks secrets via an explicit field-by-field blocklist that omits three values the project's own configuration-export path deliberately strips: the session-cookie signing key (cookieKey), the encrypted-notebook key material (notebookCrypto), and the Pandoc binary path, which embeds the OS username. The route is gated only by CheckAuth, so publish RoleReader tokens can call it, and on instances with Publish.Auth.Enable set to false it is reachable by completely anonymous HTTP requests. An attacker who reads cookieKey obtains the gorilla/securecookie HMAC key used to sign the 'siyuan' session cookie and can mint or modify session cookies the server accepts as authentic; privilege escalation to administrator succeeds whenever no AccessAuthCode is configured, which the analysis describes as a common deployment. All SiYuan deployments that expose the publish API anonymously or to reader tokens are affected (fixed version range not specified in the available data). There is no public PoC, no CISA KEV listing, and EPSS is 0.2%, so no exploitation is currently known.

What to do: Until a patched release is available, restrict access to /api/system/getConf by requiring administrator privileges and disabling anonymous publish access (set Publish.Auth.Enable to true), and check whether an AccessAuthCode is configured, since its absence makes forged-session admin escalation trivial. Because the session-cookie signing key (cookieKey) and notebookCrypto key may have been disclosed to anonymous readers, rotate both on exposed instances to invalidate any forged sessions.