CVE-2026-72794: siyuan 0 to before 3.7.4

Affected technology

siyuan · 0 to before 3.7.4
siyuan-note

Description’s affected range: versions before v3.7.4 expose the session cookie signing key through the /api/system/getConf endpoint to unauthenticated users in publish mode

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Attackers can retrieve the CookieKey value and forge valid session cookies to impersonate users or gain administrative access. Vendor/CNA’s CVSS 4.0 assessment (base score 9.2/10) rates confidentiality impact as high; integrity and availability impact as none.