{"uuid": "bf4924b6-977e-48fe-968c-a9dd376ad45a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72794", "type": "seen", "source": "https://gist.github.com/alon710/dc010738b4571d3213f407464873e777", "content": "# CVE-2026-72794: CVE-2026-72794: Cryptographic Key Leakage and Session Forgery in SiYuan\n\n> **CVSS Score:** 8.6\n> **Published:** 2026-09-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-72794\n\n## Summary\nAn information disclosure vulnerability in the SiYuan application exposes the global session cookie signing key via the `/api/system/getConf` endpoint. This allows unauthenticated remote attackers or low-privileged users to forge administrative session cookies and gain unauthorized access to the application kernel.\n\n## TL;DR\nUnauthenticated remote attackers can extract the session-signing secret key from the configuration endpoint and forge session cookies to obtain administrative access.\n\n## Technical Details\n\n- **CWE ID**: CWE-522\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 8.6\n- **EPSS Score**: 0.00249\n- **Exploit Status**: PoC available\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- SiYuan personal knowledge management system\n- **siyuan**: < 3.7.4 (Fixed in: `v3.7.4`)\n\n## Mitigation\n\n- Upgrade to SiYuan v3.7.4 or later\n- Rotate the exposed CookieKey in the configuration file\n- Enforce access controls on the network level for the admin API\n\n**Remediation Steps:**\n1. Stop the SiYuan service instance\n2. Backup the configuration file (conf.json)\n3. Update the application binaries to version 3.7.4\n4. Locate the 'CookieKey' field in the configuration and replace it with a new cryptographically secure random string\n5. Restart the SiYuan service\n6. Verify that accessing /api/system/getConf without credentials no longer returns the cookieKey parameter\n\n## References\n\n- [GHSA-34fj-mwm6-fjfg: Session Cookie Key Disclosure in SiYuan](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-34fj-mwm6-fjfg)\n- [Fix Commit: Clear CookieKey in GetMaskedConf and HideConfSecret](https://github.com/siyuan-note/siyuan/commit/77421530be4ab1f43310d0f50fbab05d16c38675)\n- [VulnCheck Advisory: SiYuan Session Cookie Key Disclosure](https://www.vulncheck.com/advisories/siyuan-before-session-cookie-key-disclosure-via-getconf)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-72794) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-05T07:32:25.151952Z"}