SiYuan versions before v3.7.4 fail to mask sensitive configuration fields in the /api/system/getConf endpoint, allowing anonymous or publish-reader users to obtain the session-cookie signing key, OS username via pandoc path, and encrypted-notebook key material. Attackers can forge and tamper with session cookies to impersonate users, and on instances without access-auth codes configured, escalate to administ...
id: GO-ID-PENDING
modules:
- module: github.com/siyuan-note/siyuan/kernel
vulnerable_at: 0.0.0-20260830025221-44a6c212a994
summary: |-
Duplicate Advisory: Non-administrator responses from /api/system/getConf omit
three secrets that the configuration-export path explicitly strips, disclosing
the session-cookie signing key and the OS username to anonymous readers in github.com/siyuan-note/siyuan/kernel
ghsas:
- GHSA-2qqv-3jgq-vpm9
references:
- advisory: https://github.com/advisories/GHSA-2qqv-3jgq-vpm9
- web: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-h4v5-crx2-3cv4
- web: https://nvd.nist.gov/vuln/detail/CVE-2026-72793
- web: https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-api-system-getconf
source:
id: GHSA-2qqv-3jgq-vpm9
created: 2026-09-04T22:01:49.723882064Z
review_status: UNREVIEWED
Advisory GHSA-2qqv-3jgq-vpm9 references a vulnerability in the following Go modules:
Description:
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-h4v5-crx2-3cv4. This link is maintained to preserve external references.
Original Description
SiYuan versions before v3.7.4 fail to mask sensitive configuration fields in the /api/system/getConf endpoint, allowing anonymous or publish-reader users to obtain the session-cookie signing key, OS username via pandoc path, and encrypted-notebook key material. Attackers can forge and tamper with session cookies to impersonate users, and on instances without access-auth codes configured, escalate to administ...
References:
Cross references:
See doc/quickstart.md for instructions on how to triage this report.