CVE-2026-72793 siyuan-note CVE debrief

Who should care

SiYuan users and administrators, security teams monitoring session cookie abuse, developers using SiYuan's API, and operators managing affected deployments should be aware of this critical vulnerability and take immediate action to protect their environments.

Technical summary

The SiYuan note-taking application versions before v3.7.4 are vulnerable to information disclosure via the /api/system/getConf endpoint. This endpoint fails to mask sensitive configuration fields, exposing critical information such as the session-cookie signing key, OS username via pandoc path, and encrypted-notebook key material. The vulnerability, tracked as CVE-2026-72793, has a CVSS score of 9.2, indicating critical severity. Exploitation allows attackers to forge and tamper with session cookies, potentially leading to user impersonation and, in certain configurations, escalation to administrator privileges.

Defensive priority

Critical vulnerability in SiYuan, allowing session cookie forgery and potential privilege escalation.

Recommended defensive actions

• Inventory and verify SiYuan version, applying v3.7.4 or later if vulnerable
• Restrict access to /api/system/getConf endpoint
• Implement access-auth codes for additional security
• Monitor for suspicious session cookie activity
• Consider compensating controls for sensitive data exposure

Evidence notes

The CVE-2026-72793 vulnerability affects SiYuan versions before v3.7.4, allowing sensitive configuration fields to be unmasked via the /api/system/getConf endpoint. This exposure includes the session-cookie signing key, OS username via pandoc path, and encrypted-notebook key material. Consequently, attackers can forge and tamper with session cookies to impersonate users. On instances lacking access-auth codes, this could lead to escalation of privileges to administrator level. Official records indicate a CVSS score of 9.2, categorizing this as a Critical vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.