CVE-2026-72793: SiYuan: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key and the OS username to anonymous readers
/api/system/getConf is registered with CheckAuth only and is reachable by the publish RoleReader token, and anonymously when Publish.Auth.Enable is false. Its non-administrator masking chain is a blocklist that enumerates fields individually. Three fields that the configuration-export endpoint in the same file deliberately clears are absent from that blocklist and are returned to readers:
| Field | JSON | What it is | Cleared by exportConf at |
|---|---|---|---|
Conf.CookieKey | cookieKey | The session-cookie signing key | kernel/api/system.go:360 |
Conf.Export.PandocBin | export.pandocBin | Absolute path embedding the OS username | kernel/api/system.go:338 |
Conf.NotebookCrypto | notebookCrypto | Encrypted-notebook key material | kernel/api/system.go:360 |
The project has already classified all three as values that must not leave the server. The reader-facing path returns them.
References
- github.com/advisories/GHSA-h4v5-crx2-3cv4
- github.com/siyuan-note/siyuan/commit/2d8b98395a910251aea87e90a4fad9c7f954befe
- github.com/siyuan-note/siyuan/security/advisories/GHSA-h4v5-crx2-3cv4
- nvd.nist.gov/vuln/detail/CVE-2026-72793
- www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-api-system-getconf
Code Behaviors & Features
Detect and mitigate CVE-2026-72793 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →