CVE-2026-72794 is a critical security vulnerability in siyuan-note software versions prior to v3.7.4. The flaw involves insufficient protection of credentials, specifically the session cookie signing key, which is exposed through the /api/system/getConf endpoint when the software is in publish mode. Because this endpoint is accessible without authentication, attackers can obtain the CookieKey value and use it to create forged session cookies. This can lead to unauthorized user impersonation or administrative privilege escalation. The vulnerability has a CVSS 4.0 score of 9.2, indicating a high severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality and security capabilities.

Attackers can retrieve the session cookie signing key without authentication and forge valid session cookies. This enables them to impersonate legitimate users or gain administrative access, compromising confidentiality and control over the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /api/system/getConf endpoint in publish mode or disable publish mode if possible to prevent exposure of the CookieKey.