CVE-2026-72793

creationtimestamp| type| source ---|---|--- 2026-08-14 23:10:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mt3bpvu7ql2m 2026-09-04 22:35:05+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-h4v5-crx2-3cv4 2026-09-05 05:32:57+00:00| seen|...

CVE-2026-72793

SiYuan before v3.7.4 exposes sensitive configuration data via /api/system/getConf. The root cause is failure to mask fields such as the session-cookie signing key, OS username (via pandoc path), and encrypted-notebook key material, enabling anonymous or publish-reader users to access these secret...

CVE-2026-72793 SiYuan before v3.7.4 Information Disclosure via /api/system/getConf

SiYuan versions before v3.7.4 fail to mask sensitive configuration fields in the /api/system/getConf endpoint, allowing anonymous or publish-reader users to obtain the session-cookie signing key, OS username via pandoc path, and encrypted-notebook key material. Attackers can forge and tamper with...