Kernel: Duplicate Advisory: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key…

SiYuan versions prior to 3.7.4 expose sensitive configuration data through the /api/system/getConf API endpoint to non-administrator users. This includes the session-cookie signing key, OS username, and encrypted-notebook keys. The lack of masking in this endpoint allows attackers to forge session cookies, enabling user impersonation and privilege escalation in certain configurations. This vulnerability is tracked as GHSA-2qqv-3jgq-vpm9 and has a CVSS 3.1 score of 8.6, indicating critical severity.

Attackers can obtain the session-cookie signing key and other sensitive secrets, allowing them to forge and tamper with session cookies to impersonate users. On systems without configured access-auth codes, this can lead to privilege escalation to administrator level. The confidentiality of sensitive configuration data is compromised, but there is no indication of direct integrity or availability impact.

No official patch link is provided in the data. The vulnerability affects versions up to 3.7.3, implying that upgrading to version 3.7.4 or later would remediate the issue. Users should verify with the vendor or official advisories for patch availability and apply updates accordingly. Until patched, restricting access to the /api/system/getConf endpoint and configuring access-auth codes can reduce risk.