{"vulnerability": "cve-2026-72793", "sightings": [{"uuid": "5242a5f9-6c54-4224-948f-795775b16202", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72793", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mt3bpvu7ql2m", "content": "CVE-2026-72793 - siyuan\nSiYuan versions before v3.7.4 expose sensitive information, including a key used to verify user sessions and potentially allow attackers to impersonate users or gain administrator\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#siyuan #siyuannote #CVE #infosec", "creation_timestamp": "2026-08-14T23:10:05.692757Z"}, {"uuid": "c4ac6f3f-8dfb-4738-bca2-7bda277b4f24", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-72793", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-h4v5-crx2-3cv4", "content": "", "creation_timestamp": "2026-09-04T22:35:05.601384Z"}, {"uuid": "1c58d0db-df1c-4c4e-a64f-f54441029a0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72793", "type": "seen", "source": "https://gist.github.com/alon710/8e52edc7cac5d27a87a28f37b7cbdf23", "content": "# CVE-2026-72793: CVE-2026-72793: Information Disclosure and Session Forgery in SiYuan Note-Taking Application\n\n> **CVSS Score:** 8.6\n> **Published:** 2026-09-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-72793\n\n## Summary\nA critical information disclosure vulnerability in the SiYuan note-taking application allows remote attackers to retrieve sensitive configurations, including cryptographic session-cookie signing keys and absolute host system directories, leading to administrative session hijacking.\n\n## TL;DR\nIncomplete secret masking in the `/api/system/getConf` endpoint of SiYuan before v3.7.4 exposes session-cookie signing keys and absolute system directories, allowing attackers to hijack administrative sessions.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-522\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 8.6 (v3.1) / 9.2 (v4.0)\n- **Exploit Status**: Proof of Concept\n- **KEV Status**: Not Listed\n- **Vulnerability Type**: Information Disclosure / Insufficiently Protected Credentials\n\n## Affected Systems\n\n- SiYuan Personal Knowledge Management System\n- **SiYuan**: < 3.7.4 (Fixed in: `3.7.4`)\n\n## Mitigation\n\n- Upgrade the SiYuan note-taking application to version 3.7.4 or later.\n- Enforce strong access-authorization codes in the application settings.\n- Rotate the session-cookie configuration parameters after upgrading.\n\n**Remediation Steps:**\n1. Identify all active SiYuan deployments in your environment.\n2. Download and apply the v3.7.4 or later update package.\n3. Access the settings panel and set a complex access-authorization code.\n4. Restart the service to generate a new session cookie key and invalidate old sessions.\n\n## References\n\n- [GHSA-h4v5-crx2-3cv4: SiYuan Information Disclosure in getConf](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-h4v5-crx2-3cv4)\n- [VulnCheck Independent Advisory](https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-api-system-getconf)\n- [Remediation Patch Commit](https://github.com/siyuan-note/siyuan/commit/2d8b98395a910251aea87e90a4fad9c7f954befe)\n- [Official CVE Entry Record](https://www.cve.org/CVERecord?id=CVE-2026-72793)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-72793) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-05T05:32:57.610433Z"}]}