high · 8.6CVE-2026-72793Sep 4, 2026

CVE-2026-72793: SiYuan /api/system/getConf Credential Disclosure

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

SiYuan's configuration API hands the session-cookie signing key, the OS username, and encrypted-notebook key material to any anonymous reader when publish mode is on, because the non-admin masking…

Packagegithub.com/siyuan-note/siyuan/kernel
Ecosystemgo
Affected< 0.0.0-20260725132049-2d8b98395a91
Fixed in0.0.0-20260725132049-2d8b98395a91
CVE-2026-72793: SiYuan /api/system/getConf Credential Disclosure

The problem

The route POST /api/system/getConf is guarded by CheckAuth only, making it reachable anonymously when Publish.Auth.Enable is false, or by any publish RoleReader token.

The non-administrator masking chain (GetMaskedConf -> HideConfSecret -> FilterConfByPublishIgnore) names secrets field by field. Three fields that the config-export handler (exportConf) deliberately clears before responding were never added to that list: cookieKey (the live HMAC signing key for the siyuan session cookie), export.pandocBin (an absolute path that embeds the OS username, bypassing the IsBrowserRequest block added specifically to prevent username leakage), and notebookCrypto (Argon2id salt, cost parameters, KEK verifier, and wrapped per-notebook AES key).

Any field absent from the blocklist is returned by default.

Proof of concept

A working proof-of-concept for CVE-2026-72793 in github.com/siyuan-note/siyuan/kernel, with the exact payload below.

bash
# Step 1: retrieve the signing key and secrets anonymously
curl -s -X POST http://127.0.0.1:6808/api/system/getConf \
     -H 'Content-Type: application/json' \
     -d '{}' | jq '{cookieKey: .data.conf.cookieKey, pandocBin: .data.conf.export.pandocBin, notebookCrypto: .data.conf.notebookCrypto}'

# Differential confirmation: the same fields are empty on the export endpoint
curl -s -X POST http://127.0.0.1:6808/api/system/exportConf \
     -H 'Content-Type: application/json' \
     -d '{}' | jq '{cookieKey: .data.conf.cookieKey, pandocBin: .data.conf.export.pandocBin, notebookCrypto: .data.conf.notebookCrypto}'

The root cause is a diverged blocklist. exportConf (kernel/api/system.go) clones the config and zeroes each secret before responding, giving it the project's own working inventory of what must not leave the server. HideConfSecret, used by the reader path, maintains a separate shorter list that omits CookieKey, Export.PandocBin, and NotebookCrypto.

CookieKey is passed directly to cookie.NewStore at startup and becomes the gorilla/securecookie HMAC key for the siyuan session cookie, so an attacker holding it can mint cookies the server accepts as authentic. Export.PandocBin resolves to C:\Users\<username>\SiYuan\temp\pandoc\bin\pandoc.exe, leaking the OS username even though the IsBrowserRequest block at line 630 was added with the comment 'avoid leaking the username and other sensitive information'.

That block only clears System.* fields and misses this one. NotebookCrypto provides the material needed for an offline password-guessing attack against encrypted notebooks (CWE-522: Insufficiently Protected Credentials). The patch commit 2d8b98395a routes the non-admin response through the same clearing logic used by exportConf, closing all three gaps at once.

The fix

Upgrade to commit 2d8b98395a910251aea87e90a4fad9c7f954befe or the corresponding tagged release (pseudo-version 0.0.0-20260725132049-2d8b98395a91). The fix routes the non-administrator getConf response through the same config-cloning and secret-clearing logic already used by exportConf, rather than extending HideConfSecret field by field.

If an immediate upgrade is not possible, disable publish mode (Publish.Auth.Enable = true with no reader tokens issued) as a temporary mitigation.

Reporter not attributed.

References: [1][2][3][4][5]

Related research