Executive brief
SiYuan is a privacy-focused note-taking application that supports collaboration through a publish mode. A vulnerability in the configuration API endpoint exposes three critical secrets to unauthenticated users: the session signing key (allowing attackers to forge user sessions), the operating system username, and encrypted notebook keys. An attacker can use these secrets to impersonate legitimate users or escalate privileges to administrator level, potentially gaining full control of the application and accessing sensitive data.
Technical details
The vulnerability is an information disclosure flaw in the /api/system/getConf endpoint caused by an incomplete blocklist in the non-administrator masking function. The endpoint uses a field-by-field enumeration approach (HideConfSecret) to strip secrets, but three fields are omitted: Conf.CookieKey (session HMAC key), Conf.Export.PandocBin (absolute path containing OS username), and Conf.NotebookCrypto (encrypted-notebook key material). These same three fields are explicitly cleared by the separate exportConf endpoint, indicating they were known secrets. The endpoint is reachable by anonymous users when Publish.Auth.Enable is false, and by any publish-reader token holder. Attack vector is network-based with no authentication or user interaction required. An attacker can immediately forge valid session cookies using the disclosed CookieKey; on instances without AccessAuthCode configured (common deployment), this permits direct escalation to administrator privileges. Additionally, a browser-request privacy control (blanking System.* paths to prevent username disclosure) is bypassed because Export.PandocBin is not included in that block. The root cause is maintaining two divergent lists of secrets instead of reusing the exportConf sanitization logic.
Affected products
- SiYuan SiYuan <= 3.7.3
Timeline
- 2026-08-12: disclosed: Advisory published
- 2026: patched: Fix available in v3.7.4