CVE-2026-72793: CVE-2026-72793: Information Disclosure and Session Forgery in SiYuan Note-Taking Application

CVE-2026-72793: Information Disclosure and Session Forgery in SiYuan Note-Taking Application

Vulnerability ID: CVE-2026-72793
CVSS Score: 8.6
Published: 2026-09-04

A critical information disclosure vulnerability in the SiYuan note-taking application allows remote attackers to retrieve sensitive configurations, including cryptographic session-cookie signing keys and absolute host system directories, leading to administrative session hijacking.

TL;DR

Incomplete secret masking in the /api/system/getConf endpoint of SiYuan before v3.7.4 exposes session-cookie signing keys and absolute system directories, allowing attackers to hijack administrative sessions.

---

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-522
• Attack Vector: Network (AV:N)
• CVSS Score: 8.6 (v3.1) / 9.2 (v4.0)
• Exploit Status: Proof of Concept
• KEV Status: Not Listed
• Vulnerability Type: Information Disclosure / Insufficiently Protected Credentials

Affected Systems

• SiYuan Personal Knowledge Management System
• SiYuan: < 3.7.4 (Fixed in: 3.7.4)

Code Analysis

Commit: 2d8b983

Hide export and system configurations in HideConfSecret

@@ -1253,6 +1253,9 @@ func HideConfSecret(c *AppConf) {
    c.MCPOAuth = ""
    c.CookieKey = ""
    c.Api = &conf.API{}
+   if nil != c.Export {
+       c.Export.PandocBin = ""
+   }
    c.Flashcard = &conf.Flashcard{}
    c.ServerAddrs = []string{}
    c.Publish = &conf.Publish{}
@@ -1270,6 +1273,7 @@ func HideConfSecret(c *AppConf) {
    c.System.ConfDir = ""
    c.System.DataDir = ""
    c.System.HomeDir = ""
+   c.System.WorkspaceDir = ""
    c.System.Name = ""
    c.System.NetworkProxy = &conf.NetworkProxy{}

Mitigation Strategies

• Upgrade the SiYuan note-taking application to version 3.7.4 or later.
• Enforce strong access-authorization codes in the application settings.
• Rotate the session-cookie configuration parameters after upgrading.

Remediation Steps:

1. Identify all active SiYuan deployments in your environment.
2. Download and apply the v3.7.4 or later update package.
3. Access the settings panel and set a complex access-authorization code.
4. Restart the service to generate a new session cookie key and invalidate old sessions.

References

• GHSA-h4v5-crx2-3cv4: SiYuan Information Disclosure in getConf
• VulnCheck Independent Advisory
• Remediation Patch Commit
• Official CVE Entry Record

---

Read the full report for CVE-2026-72793 on our website for more details including interactive diagrams and full exploit analysis.