Executive brief
SiYuan is a note-taking application that uses a cryptographic signing key to secure user session cookies. The `/api/system/getConf` API endpoint incorrectly exposes this signing key in its response to anonymous users and readers in publish mode. An attacker with access to this key can forge valid session cookies to impersonate users, potentially including administrators if no access code is configured, without needing to compromise any user credentials.
Technical details
The vulnerability is an insufficiently protected credentials disclosure (CWE-522) in the configuration retrieval endpoint. The `/api/system/getConf` route is protected only by `CheckAuth` middleware, allowing access by publish-mode readers and anonymous users when `Publish.Auth.Enable` is false. The leaked field `AppConf.CookieKey` is a live HMAC secret used to sign the `siyuan` session cookie via `gorilla/securecookie`. The masking chain (`GetMaskedConf` → `HideConfSecret` → `FilterConfByPublishIgnore`) fails to remove this field at any stage, unlike the `exportConf` endpoint which explicitly clears both `CookieKey` and `NotebookCrypto`. An attacker obtaining this key can use `gin-contrib/sessions/cookie.NewStore` logic to forge valid session cookies. Escalation to administrator requires either no access-auth code configured or possession of the matching `AccessAuthCode`. The key is persistent and rotation invalidates all sessions, making this a critical secret disclosure. A patch was released in version 0.0.0-20260725123945-77421530be4a.
Affected products
- siyuan-note SiYuan < 0.0.0-20260725123945-77421530be4a
Timeline
- 2026-09-04: disclosed: Published to GitHub Advisory Database
- 2026-07-25: patched: Patch version 0.0.0-20260725123945-77421530be4a released