CVE-2026-72794

SiYuan's POST /api/system/getConf endpoint returns the server's session-cookie signing key (Conf.CookieKey, serialized as cookieKey) in its response body, because the route is gated only by CheckAuth with no admin-role requirement, so the field reaches publish RoleReader tokens and fully anonymous readers when Publish.Auth.Enable is false. None of the configuration-masking layers (GetMaskedConf, HideConfSecret, FilterConfByPublishIgnore, or the browser-side System-path strip) removes this field, even though the sibling exportConf endpoint explicitly clears it as a secret. Since the key is used at startup as the gorilla/securecookie HMAC key for the 'siyuan' session cookie, an attacker who obtains it can mint or tamper with session cookies that the server accepts as authentic; full privilege escalation to administrator additionally requires a matching AccessAuthCode, which is masked, or an instance without one configured. Any self-hosted SiYuan instance in server mode that exposes this API to unauthenticated or reader-level users is affected; specific affected version ranges are not provided in the available data. No public proof-of-concept, KEV listing, or in-the-wild exploitation is known, and EPSS estimates only about a 0.2% chance of exploitation within 30 days.

What to do: Upgrade SiYuan to a release that strips CookieKey from /api/system/getConf once available, and if your instance was internet-exposed, rotate the cookie signing key so any leaked value is invalidated. As interim mitigation, restrict access to /api/system/getConf at a reverse proxy, enable Publish.Auth.Enable, and ensure an AccessAuthCode is configured to cap forged sessions at reader level.