Kernel: Duplicate Advisory: The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by /api/system/getConf

In Siyuan versions <=3.7.2, the session cookie signing key (Conf.CookieKey) is exposed through the /api/system/getConf endpoint to anonymous users when the system is in publish mode. This exposure enables attackers to obtain the CookieKey and create forged session cookies, which can be used to impersonate legitimate users or escalate privileges to administrative access. The vulnerability corresponds to CWE-522 (Insufficiently Protected Credentials) and has a critical severity rating with a CVSS 3.1 score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N). No patch links are provided in the data, and this advisory is marked as a duplicate of GHSA-34fj-mwm6-fjfg.

Attackers can retrieve the session cookie signing key without authentication and forge valid session cookies. This allows impersonation of users and potentially gaining administrative access, leading to a complete compromise of user sessions. The vulnerability does not affect availability or integrity directly but has a high confidentiality impact due to exposure of sensitive credentials.

Patch status is not yet confirmed — check the vendor advisory GHSA-34fj-mwm6-fjfg for current remediation guidance. Since this advisory is a duplicate and withdrawn, refer to the original advisory for official fixes or mitigations. Until patched, avoid exposing the /api/system/getConf endpoint to unauthenticated users in publish mode or restrict access to trusted users only.