CVE-2026-72794: SiYuan: The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by /api/system/getConf
/api/system/getConf returns Conf.CookieKey, the key used to sign the server’s session cookies in its response body. The endpoint is registered with CheckAuth only, so the field reaches the publish RoleReader token and the anonymous account when Publish.Auth.Enable is false.
The configuration-export endpoint in the same file strips this exact field before returning config, so the project already treats it as secret. The reader-facing masking path does not.
References
- github.com/advisories/GHSA-34fj-mwm6-fjfg
- github.com/siyuan-note/siyuan/commit/77421530be4ab1f43310d0f50fbab05d16c38675
- github.com/siyuan-note/siyuan/security/advisories/GHSA-34fj-mwm6-fjfg
- nvd.nist.gov/vuln/detail/CVE-2026-72794
- www.vulncheck.com/advisories/siyuan-before-session-cookie-key-disclosure-via-getconf
Code Behaviors & Features
Detect and mitigate CVE-2026-72794 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →