CVE-2026-72794

creationtimestamp| type| source ---|---|--- 2026-09-04 22:35:09+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-34fj-mwm6-fjfg 2026-09-05 07:32:25+00:00| seen| https://gist.github.com/alon710/dc010738b4571d3213f407464873e777...

CVE-2026-72794 siyuan before v3.7.4 Session Cookie Key Disclosure via getConf

siyuan versions before v3.7.4 expose the session cookie signing key through the /api/system/getConf endpoint to unauthenticated users in publish mode. Attackers can retrieve the CookieKey value and forge valid session cookies to impersonate users or gain administrative access...

CVE-2026-72794

CVE-2026-72794 affects Siyuan before v3.7.4. The vulnerability arises because the /api/system/getConf endpoint leaks the session cookie signing key to unauthenticated users in publish mode, enabling forgery of valid session cookies and potential user impersonation or administrative access. Affect...