CVE-2026-72794: CVE-2026-72794: Cryptographic Key Leakage and Session Forgery in SiYuan

CVE-2026-72794: Cryptographic Key Leakage and Session Forgery in SiYuan

Vulnerability ID: CVE-2026-72794
CVSS Score: 8.6
Published: 2026-09-04

An information disclosure vulnerability in the SiYuan application exposes the global session cookie signing key via the /api/system/getConf endpoint. This allows unauthenticated remote attackers or low-privileged users to forge administrative session cookies and gain unauthorized access to the application kernel.

TL;DR

Unauthenticated remote attackers can extract the session-signing secret key from the configuration endpoint and forge session cookies to obtain administrative access.

---

Technical Details

• CWE ID: CWE-522
• Attack Vector: Network
• CVSS v3.1 Score: 8.6
• EPSS Score: 0.00249
• Exploit Status: PoC available
• KEV Status: Not listed

Affected Systems

• SiYuan personal knowledge management system
• siyuan: < 3.7.4 (Fixed in: v3.7.4)

Code Analysis

Commit: 7742153

Clear CookieKey in GetMaskedConf and HideConfSecret

Mitigation Strategies

• Upgrade to SiYuan v3.7.4 or later
• Rotate the exposed CookieKey in the configuration file
• Enforce access controls on the network level for the admin API

Remediation Steps:

1. Stop the SiYuan service instance
2. Backup the configuration file (conf.json)
3. Update the application binaries to version 3.7.4
4. Locate the 'CookieKey' field in the configuration and replace it with a new cryptographically secure random string
5. Restart the SiYuan service
6. Verify that accessing /api/system/getConf without credentials no longer returns the cookieKey parameter

References

• GHSA-34fj-mwm6-fjfg: Session Cookie Key Disclosure in SiYuan
• Fix Commit: Clear CookieKey in GetMaskedConf and HideConfSecret
• VulnCheck Advisory: SiYuan Session Cookie Key Disclosure

---

Read the full report for CVE-2026-72794 on our website for more details including interactive diagrams and full exploit analysis.