CVE-2026-72793: Information Disclosure and Session Forgery in SiYuan Note-Taking Application

SiYuan is an open-source, local-first personal knowledge management platform designed to run as a local server or self-hosted web application. The platform exposes various API endpoints to handle system configuration, notebook synchronization, and user authorization. One of these endpoints, /api/system/getConf, serves system configuration states directly to client interfaces.

In versions prior to v3.7.4, the /api/system/getConf endpoint fails to sufficiently sanitize internal configuration parameters before writing the serialized JSON response. Although a dedicated secret-masking function is implemented on the backend, the default behavior exposes newly added or unhandled parameters due to an incomplete exclusionary design. Consequently, an unauthenticated user or low-privilege reader can query this endpoint to retrieve critical configuration details.

The exposed parameters include the session-cookie cryptographic signing key and absolute local directory paths. This exposure significantly broadens the attack surface of self-hosted instances. It provides malicious actors with the cryptographic material required to forge administrator session tokens, completely bypassing the primary access controls of the platform.

The root cause of CVE-2026-72793 lies in an inconsistent security posture across configuration retrieval endpoints combined with a fragile blocklist design. The SiYuan application separates configuration exposure into multiple API routes, such as /api/system/exportConf and /api/system/getConf. While the former implements an intensive sanitization process by deep-copying and whitelist-filtering data, the latter retrieves the live configuration struct and applies a localized redaction function.

This localized redaction function, named HideConfSecret, is defined within kernel/model/conf.go. This function uses an exclusionary blocklist approach, manually setting known sensitive variables to their default zero-values before the struct is serialized and returned to the client. This design pattern presents inherent security risks because any configuration field added during development remains fully exposed by default unless the developer manually updates the HideConfSecret function.

In versions prior to v3.7.4, several critical variables were omitted from this blocklist. These omitted variables include CookieKey, which is the HMAC secret used to validate user session tokens, and absolute path variables such as System.WorkspaceDir and Export.PandocBin. The omission of these variables allows any HTTP request that successfully hits /api/system/getConf to receive the plaintext session-signing secret and host file path structures.

An analysis of the patch introduced in commit 2d8b98395a910251aea87e90a4fad9c7f954befe demonstrates the remediation of the blocklist omissions. In the vulnerable version of the codebase, the HideConfSecret function failed to inspect or clear fields within the Export configuration struct or the absolute directory configuration values within the System configuration struct. This omission allowed absolute installation paths to leak.

The following code comparison illustrates the patch applied to kernel/model/conf.go to explicitly redact the vulnerable fields:

// Before the patch, c.Export.PandocBin and c.System.WorkspaceDir remained fully populated.
func HideConfSecret(c *AppConf) {
	c.MCPOAuth = ""
	c.CookieKey = ""
	c.Api = &conf.API{}
+	if nil != c.Export {
+		c.Export.PandocBin = "" // Correctly redacts the absolute path to Pandoc binary
+	}
	c.Flashcard = &conf.Flashcard{}
	c.ServerAddrs = []string{}
	c.Publish = &conf.Publish{}
@@ -1270,6 +1273,7 @@ func HideConfSecret(c *AppConf) {
	c.System.ConfDir = ""
	c.System.DataDir = ""
	c.System.HomeDir = ""
+	c.System.WorkspaceDir = "" // Correctly redacts the absolute path of the workspace
	c.System.Name = ""
	c.System.NetworkProxy = &conf.NetworkProxy{}
}

Additionally, the developers implemented a robust unit test suite within kernel/model/conf_secret_test.go to verify the sanitization of these sensitive paths. The test initializes a mock AppConf structure containing realistic file path properties on both Windows and Linux, executes HideConfSecret, and asserts that all directory paths and keys are reduced to empty strings. This regression test prevents future code additions from accidentally exposing host file paths through these interfaces.

To exploit this vulnerability, an attacker must first locate an exposed SiYuan instance over the network. Because the /api/system/getConf endpoint is registered with standard authorization handlers rather than restricted administrative middleware, users with general reading or publishing access can query it. If the server does not enforce an access authorization code, the query can be performed anonymously.

The attacker issues an HTTP POST request to the /api/system/getConf path with an empty JSON object. The server processes the request, applies the incomplete HideConfSecret sanitizer, and returns the configuration JSON document. The attacker parses this response to locate the cookieKey field containing the raw HMAC secret, alongside absolute path variables that reveal the host operating system and username.

Once the cryptographic cookieKey is obtained, the attacker can generate a valid, signed administrative session cookie locally. Because the SiYuan backend validates session identity signatures using this specific key, the server accepts the forged cookie as a valid credential. This signature validation bypass provides the attacker with immediate administrative access to the active workspace.

The exposure of the session-cookie signing key allows for a complete bypass of the application's authentication model. Attackers can forge sessions for any active user, including the primary administrator. This access level permits the remote execution of arbitrary workspace management functions, such as data modifications, file uploads, and configuration overrides.

Additionally, the exposure of absolute path variables such as Export.PandocBin and System.WorkspaceDir compromises host system privacy. These paths typically contain the local operating system username, exposing the file system hierarchy of the host. This metadata allows attackers to tailor subsequent host-level attacks, such as directory traversal or local privilege escalation exploits.

Under CVSS v3.1, this vulnerability is rated 8.6, reflecting high confidentiality compromise. When evaluated under CVSS v4.0, the vulnerability scores 9.2, as the exploitation of the cryptographic key material directly leads to downstream integrity and availability compromise on the system hosting the application.

The primary remediation for CVE-2026-72793 is to upgrade the SiYuan application to version 3.7.4 or later. The update completely replaces the vulnerable configuration endpoints' data exposure by zeroing out the sensitive paths and session keys before serialization. Administrators should verify their current container, desktop, or server versions and apply the official updates immediately.

If patching cannot be executed immediately, administrators must implement access-authorization codes within the SiYuan settings. Enforcing an access-auth code restricts interaction with the API endpoints, blocking unauthorized queries. This access constraint prevents attackers from reaching the vulnerable /api/system/getConf interface without possessing the pre-shared authorization token.

As a defense-in-depth measure, administrators should rotate the session cookie configuration parameters upon upgrading. Since historical CookieKey values may have been logged or cached during the period of vulnerability, rotation ensures that any previously compromised key material is rendered invalid. This action terminates all existing sessions, neutralizing the risk of persistent unauthorized access.