Executive brief
SiYuan is a note-taking application with a configuration API endpoint that is accessible to anonymous users or readers with limited permissions. The endpoint inadvertently exposes three sensitive values that should remain server-only: the session-cookie signing key (used to create forged sessions), the operating system username embedded in file paths, and encrypted-notebook key material. An unauthenticated attacker can obtain these secrets and use the session key to forge valid session cookies, potentially gaining administrator access if the instance has no additional access-control code configured.
Technical details
The vulnerability is a multi-field information disclosure in the POST /api/system/getConf endpoint, which is protected only by CheckAuth and is reachable by publish RoleReader tokens or anonymously when Publish.Auth.Enable is false. The endpoint's non-administrator response filtering uses a blocklist in HideConfSecret() that enumerates fields to mask individually; three sensitive fields are absent from this list. (1) CookieKey: the session-cookie HMAC signing key used by gin-contrib/sessions/cookie.NewStore, disclosed in plaintext. An attacker with this key can mint and modify session cookies that the server validates as authentic, and escalate to administrator if no AccessAuthCode is configured (a common deployment). (2) Export.PandocBin: an absolute filesystem path embedding the OS username (e.g., C:\Users\<username>\SiYuan\temp\pandoc\bin\pandoc.exe), which bypasses a privacy control added explicitly to System paths in the IsBrowserRequest() block to prevent username disclosure. (3) NotebookCrypto: encrypted-notebook key material, likewise absent from the masking chain. The root cause is the parallel exportConf endpoint's use of an allowlist cloner that correctly strips these fields, while getConf maintains a separate, divergent blocklist that has never included them. The endpoint is network-reachable without authentication in common publish-mode configurations, making exploitation trivial.
Affected products
- SiYuan SiYuan < 0.0.0-20260725132049-2d8b98395a91
Timeline
- 2026-09-04: disclosed: Advisory published for CVE-2026-72793 / GHSA-h4v5-crx2-3cv4
- 2026-07-25: patched: Patched in version 0.0.0-20260725132049-2d8b98395a91