CVE-2026-72793 affects SiYuan note-taking software versions prior to 3.7.4. The vulnerability arises because the /api/system/getConf endpoint does not mask sensitive configuration fields, allowing unauthorized users to retrieve critical secrets such as the session-cookie signing key, OS username via the pandoc path, and encrypted-notebook key material. With these secrets, attackers can forge and tamper with session cookies to impersonate legitimate users. On instances where access-auth codes are not configured, this can lead to privilege escalation to administrator level.

Attackers can obtain sensitive cryptographic keys and user information without authentication, enabling session cookie forgery and user impersonation. This can lead to unauthorized access and administrative privilege escalation on vulnerable SiYuan instances lacking access-auth codes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /api/system/getConf endpoint and configure access-auth codes to prevent unauthorized privilege escalation.