SiYuan: Non-administrator responses from /api/system/getConf omit three secrets...

Executive Summary

**CVE:** This vulnerability corresponds to [CVE-2026-72793](https://nvd.nist.gov/vuln/detail/CVE-2026-72793). ### Summary `/api/system/getConf` is registered with `CheckAuth` only and is reachable by the publish `RoleReader` token, and anonymously when `Publish.Auth.Enable` is `false`. Its non-admin. Full analysis, Sigma/YARA rules, IOCs, Attack Chain by CYBERDUDEBIVASH SENTINEL APEX v4.0.

Key Judgements

Key Judgements are derived from validated ReportX claim identifiers rather than a second free-form model request. They may prioritize validation and collection, but they do not convert source-reported claims into confirmed customer impact.

Verified Facts

• Source publisher: CYBERDUDEBIVASH
• Source published: 2026-09-04T22:50:40+00:00

Threat Classification

Report family: CVE Vulnerability Advisory. Exploitation state: Unknown — source record does not confirm active exploitation. Remediation state: Availability not established in the source record — verify vendor guidance. These labels come from the normalized report context and remain bounded by cited evidence.

Threat Severity Assessment

Severity is interpreted from structured scoring or source evidence when present. No customer-specific risk score, blast radius, or compromise state is inferred by this compiler.

Evidence & Source Assessment

Primary provenance is CYBERDUDEBIVASH. The compiler distinguishes source-reported material from independently structured NVD/CISA/EPSS evidence when those fields are actually present.

Timeline & Chronology

The normalized source publication timestamp is 2026-09-04T22:50:40+00:00. Additional intrusion, exploitation, disclosure, or remediation timestamps are not asserted unless they are present in the cited evidence body below.

Business Impact

Customer-specific business impact is not established by a public source record alone. Decision value comes from determining whether relevant assets, identities, dependencies, or services are actually present and exposed.

Enterprise Exposure Assessment

• Inventory and ownership teams should determine whether the technology or service named in the cited record exists in the environment before assigning incident status.
• A positive exposure determination requires asset, version, identity, dependency, cloud/SaaS, or equivalent internal telemetry that can be tied to the cited condition.
• A negative determination should record the inventory evidence and timestamp used so the decision can be revalidated if the source record changes.

Technical Analysis

CVE-2026-72793 identifies an information disclosure vulnerability in the SiYuan note-taking application where the /api/system/getConf endpoint returns sensitive configuration data to non-administrator and anonymous callers. The endpoint is registered with CheckAuth only, making it reachable by publish RoleReader tokens and, critically, to unauthenticated users when Publish.Auth.Enable is set to false. Non-administrator responses omit three secrets that the configuration-export path explicitly strips, yet still disclose the session-cookie signing key and the operating system username to anonymous readers.

Active exploitation of this vulnerability is not established in cited evidence. The CDB pipeline boundary field CDB_EXPLOITATION_STATUS is recorded as unknown, and CDB_KEV_LISTED is None. Organizations running SiYuan with publish authentication disabled face direct exposure of session-signing material and host identity information. Immediate defensive actions include verifying publish authentication settings, restricting network access to the SiYuan API surface, and validating whether session-cookie signing keys have been rotated after any confirmed exposure window.

The /api/system/getConf endpoint exhibits an authentication boundary misconfiguration that allows information disclosure to actors with minimal or no credentials. The session-cookie signing key disclosure creates a direct path to session forgery, which is the most consequential technical outcome of this vulnerability. The operating system username disclosure provides reconnaissance value for lateral movement and social engineering campaigns.

• Session-cookie signing key exposure enables authenticated session forgery without credential compromise.
• Anonymous access occurs when Publish.Auth.Enable is false, a configuration that may be intentional for public-facing deployments.
• The configuration-export path explicitly strips three secrets, indicating developer awareness of sensitivity but inconsistent enforcement across endpoints.
• Active exploitation is not established in cited evidence; threat posture depends on deployment configuration and network exposure.
• Organizations with SiYuan exposed to untrusted networks face the highest immediate risk.

The following facts are directly supported by the supplied source evidence and structured fields. No additional claims are asserted beyond what the source establishes.

• CVE identifier: CVE-2026-72793, referenced at the NVD database.
• Affected product: SiYuan note-taking application.
• Vulnerable endpoint: /api/system/getConf.
• Authentication registration: CheckAuth only.
• Reachable by publish RoleReader token holders.
• Reachable anonymously when Publish.Auth.Enable is false.
• Non-administrator responses disclose the session-cookie signing key.
• Non-administrator responses disclose the operating system username.
• The configuration-export path explicitly strips three secrets that the getConf endpoint does not strip.
• CDB_EXPLOITATION_STATUS: unknown.
• CDB_KEV_LISTED: None.
• Source publisher: CYBERDUDEBIVASH, published 2026-09-04.

This vulnerability is classified as an information disclosure weakness arising from an authentication boundary misconfiguration. The /api/system/getConf endpoint returns configuration data without enforcing role-based access controls beyond the CheckAuth middleware, which permits publish RoleReader tokens and anonymous access under specific configuration conditions. The disclosed data includes cryptographic material (session-cookie signing key) and host identity information (OS username), both of which are sensitive configuration secrets.

The vulnerability type aligns with broken access control and sensitive data exposure patterns. The inconsistency between the configuration-export path, which explicitly strips three secrets, and the getConf endpoint, which does not, indicates a defensive-in-depth gap in the application's authentication and authorization architecture. This is an application-layer vulnerability with no evidence of supply chain, malware, or campaign association in the cited source.

Severity assessment is conditioned on deployment configuration and network exposure. The disclosure of a session-cookie signing key is analytically assessed as HIGH severity because it enables session forgery, allowing an attacker to impersonate any authenticated user without obtaining valid credentials. The OS username disclosure is assessed as MEDIUM severity, providing reconnaissance value for targeted attacks. Combined, the exposure creates a compound risk where session forgery enables authenticated access to SiYuan's full feature set.

Organizations with Publish.Auth.Enable set to false and SiYuan exposed to untrusted networks face the highest severity posture. Deployments with publish authentication enabled and network-restricted API access face reduced but non-zero risk, as RoleReader tokens may be issued to trusted parties whose credentials could be compromised. CVSS, CWE, EPSS, and KEV status are not established in cited evidence and are not asserted.

The sole source for this report is a publication by CYBERDUDEBIVASH dated 2026-09-04, accessible at the supplied URL. The source identifies CVE-2026-72793 and describes the authentication misconfiguration of the /api/system/getConf endpoint. The structured evidence fields confirm the CVE identifier, publisher, and publication timestamp. The CDB pipeline boundary fields indicate that exploitation status is unknown and KEV listing is None.

No independent verification, vendor advisory, or secondary source corroboration is present in the supplied evidence. The source describes the technical mechanism (endpoint registration, authentication middleware, configuration flag behavior, and disclosed data elements) with sufficient specificity to support detection engineering and exposure assessment. Analyst confidence in the technical description is HIGH based on the specificity of endpoint paths, middleware names, and configuration keys. Confidence in exploitation status is LOW due to the absence of observed activity evidence.

The chronological record derived from supplied evidence is limited to the publication date of the advisory. No discovery date, disclosure date, vendor response date, or patch release date is established in cited evidence.

• 2026-09-04: CYBERDUDEBIVASH publishes advisory identifying CVE-2026-72793 and describing the /api/system/getConf authentication misconfiguration.
• Discovery date: Not established in cited evidence. Vendor or researcher disclosure timeline would resolve this gap.
• Vendor response date: Not established in cited evidence. SiYuan project maintainer communications or release notes would resolve this gap.
• Patch availability date: Not established in cited evidence. Version-specific release notes or advisory updates would resolve this gap.
• Exploitation observation date: Not established in cited evidence. Threat intelligence feeds, incident reports, or telemetry would resolve this gap.

The business impact of CVE-2026-72793 centers on unauthorized access to SiYuan workspaces through session forgery. The session-cookie signing key disclosure allows an attacker to generate valid authentication cookies, bypassing credential-based access controls entirely. This means that any data stored within SiYuan—notes, documents, attachments, and workspace configurations—becomes accessible to anyone who can reach the API endpoint. The OS username disclosure adds reconnaissance value that could support targeted phishing or lateral movement campaigns against the affected host.

Organizations using SiYuan for sensitive documentation, intellectual property, or operational notes face direct confidentiality impact. The impact is amplified in deployments where SiYuan is exposed to the internet or where publish authentication is disabled for convenience. No financial impact, regulatory applicability, or victim count is established in cited evidence. The operational consequence is potential unauthorized access to all workspace content, with severity proportional to the sensitivity of stored data and the duration of exposure.

Exposure determination requires evaluating three independent conditions: whether SiYuan is deployed, whether the Publish.Auth.Enable setting is false, and whether the SiYuan API is reachable from untrusted networks. Organizations must inventory SiYuan installations across endpoints, servers, and containerized environments. The vulnerability affects any deployment where the /api/system/getConf endpoint is accessible, regardless of version, though specific affected versions are not established in cited evidence.

• Deployments with Publish.Auth.Enable set to false and internet-exposed APIs face direct anonymous exposure.
• Deployments with publish authentication enabled face exposure to holders of RoleReader tokens.
• Network-restricted deployments (internal-only access) face reduced risk but remain vulnerable to insider threats.
• Containerized or cloud-hosted SiYuan instances require verification of ingress rules and authentication proxy configurations.
• Organizations using SiYuan for sensitive data should prioritize exposure assessment and immediate configuration review.
• Specific affected versions are not established in cited evidence; version-specific release notes would resolve this gap.

The vulnerability stems from the /api/system/getConf endpoint being registered with CheckAuth middleware only, which does not enforce role-based access controls beyond basic authentication presence. This registration allows the endpoint to be reached by publish RoleReader tokens, which are designed for read-only access to published content, and by anonymous callers when Publish.Auth.Enable is false. The endpoint returns configuration data that includes the session-cookie signing key and the operating system username, both of which are sensitive secrets.

The configuration-export path in SiYuan explicitly strips three secrets from its output, demonstrating that the development team is aware of the sensitivity of these values. However, the getConf endpoint does not apply the same stripping logic, creating an inconsistency in secret handling across the application's API surface. This inconsistency is the root cause of the information disclosure. The session-cookie signing key is particularly critical because it is used to sign authentication cookies, and its disclosure enables an attacker to forge valid session cookies for any user, effectively bypassing all credential-based authentication.

The OS username disclosure provides host identity information that could be used for reconnaissance, social engineering, or lateral movement planning. The combination of session forgery capability and host identity disclosure creates a compound attack path where an attacker can authenticate as any user and gain full access to the SiYuan workspace. No evidence of exploit code, weaponization, or active exploitation is present in the cited source.

Affected Product/Version: SiYuan note-taking application. Specific affected versions are not established in cited evidence. Version-specific release notes or vendor advisory updates would resolve this gap.

Weakness/Root Cause: The /api/system/getConf endpoint is registered with CheckAuth middleware only, which does not enforce role-based access controls. The endpoint returns configuration data without applying the same secret-stripping logic that the configuration-export path uses. This inconsistency allows sensitive secrets (session-cookie signing key and OS username) to be disclosed to non-administrator and anonymous callers.

Prerequisites: The vulnerability is exploitable when SiYuan is deployed and the /api/system/getConf endpoint is reachable. Anonymous access requires Publish.Auth.Enable to be set to false. Access via RoleReader tokens requires that such tokens have been issued and are accessible to the attacker.

Reachable Attack Surface: The /api/system/getConf endpoint is the sole attack surface identified. It is reachable by publish RoleReader token holders and by anonymous callers when publish authentication is disabled. Network exposure determines whether the endpoint is accessible from untrusted networks.

Exploitability Evidence: Active exploitation is not established in cited evidence. The CDB_EXPLOITATION_STATUS field is unknown. The technical description provides sufficient detail to construct a proof-of-concept request, but no evidence of real-world exploitation is present.

CVSS/CWE/EPSS/KEV: Not established in cited evidence. CDB_KEV_LISTED is None. Vendor advisory or NVD enrichment would resolve CVSS and CWE mappings.

Remediation/Mitigation: Enable Publish.Auth.Enable to prevent anonymous access. Restrict network access to the SiYuan API surface. Rotate session-cookie signing keys if exposure is confirmed. Verify that the configuration-export path's secret-stripping logic is applied consistently across all configuration endpoints. Vendor patch status is not established in cited evidence.

Exposure and Post-Fix Validation: Validate that Publish.Auth.Enable is set to true. Confirm that the /api/system/getConf endpoint requires appropriate authentication and role-based access controls. Verify that session-cookie signing keys have been rotated after any confirmed exposure window. Test that the endpoint no longer returns sensitive configuration data to non-administrator or anonymous callers.

ATT&CK technique mapping is conditioned on the behavior described in the source evidence. The vulnerability enables unauthorized access to sensitive configuration data, which maps to credential access and discovery techniques. The session-cookie signing key disclosure enables session forgery, which maps to session hijacking behavior.

• TA0006 - Credential Access: The session-cookie signing key disclosure enables session forgery, which is a form of credential access. The attacker obtains cryptographic material that allows them to generate valid authentication cookies.
• TA0007 - Discovery: The OS username disclosure provides host identity information, supporting reconnaissance and discovery activities.
• TA0001 - Initial Access: Session forgery via the disclosed signing key could enable initial access to the SiYuan workspace, though this is an analyst inference based on the technical mechanism described.

Specific ATT&CK technique IDs are not asserted because the source evidence does not describe adversary behavior or observed technique usage. The mappings above are analyst assessments based on the vulnerability's technical characteristics and potential abuse paths. Confidence in these mappings is MEDIUM, as they are derived from the vulnerability description rather than observed adversary activity.

The supplied evidence identifies one observable: the /api/system/getConf endpoint path. No additional IOCs, infrastructure indicators, malware artifacts, or network indicators are present in the cited source.

• Endpoint Path: /api/system/getConf — the vulnerable API endpoint that returns sensitive configuration data.
• Configuration Key: Publish.Auth.Enable — the configuration setting that controls anonymous access to the endpoint.
• Middleware Name: CheckAuth — the authentication middleware registered for the endpoint.
• Token Type: RoleReader — the publish token type that can access the endpoint.
• Disclosed Data Elements: Session-cookie signing key, operating system username.
• Stripped Secrets Count: Three secrets are explicitly stripped by the configuration-export path but not by the getConf endpoint.

No network IOCs, domain names, IP addresses, file hashes, process names, registry paths, or Event IDs are established in cited evidence. Detection engineering should focus on the endpoint path and configuration setting as the primary observables.

Detection engineering for CVE-2026-72793 should focus on monitoring access to the /api/system/getConf endpoint and identifying unauthorized access patterns. The following detection approaches are evidence-conditioned based on the source description.

• Endpoint Access Monitoring: Monitor HTTP request logs for access to /api/system/getConf. Alert on requests that lack valid authentication credentials or that originate from untrusted network segments.
• Configuration Audit: Audit SiYuan configuration files for the Publish.Auth.Enable setting. Flag instances where this setting is false, as these deployments are vulnerable to

Report-Type Deep Dive

This CVE Vulnerability Advisory record is analyzed according to the evidence available for its family. Unsupported exploit chains, malware capabilities, breach scope, attribution, encryption, exfiltration, and regulatory consequences are intentionally not synthesized.

MITRE ATT&CK Assessment

Not established in cited evidence. ATT&CK technique mapping requires source-backed behavior. Any mappings present in the preserved analytical body are subject to the existing ReportX semantic gate; the compiler adds none of its own. The factory does not infer the missing fact from absence of evidence.

Indicators & Observables

Not established in cited evidence. Only source-derived, validated and safely defanged observables may be operationalized. The compiler does not invent domains, IP addresses, hashes, paths, process names, mutexes, or command lines. The factory does not infer the missing fact from absence of evidence.

Detection Engineering Guidance

Detection content remains evidence-conditioned. Production rules require source-backed behavior plus the telemetry needed to validate precision; otherwise the correct output is a telemetry specification rather than fabricated executable logic.

Detection Validation & Required Telemetry

• Identify the telemetry source and fields needed to observe the cited behavior before promoting detection logic.
• Replay or safely simulate only evidence-supported behavior, measure expected false positives, and retain test evidence with the rule version.
• Do not represent syntax validation as production efficacy; deployment requires environment-specific validation and accountable approval.

Threat Hunting Queries

Threat hunting should begin with exposure to the technology or service named in the cited record and then pivot only on observables or behavior established in cited evidence. Absence of a source-backed pivot is an intelligence gap, not permission to invent one.

SOC Analyst Playbook

• Validate whether the affected technology, identity, dependency, service, or victim context exists internally.
• Preserve relevant logs and timestamps before destructive containment when an internal match is found.
• Escalate from intelligence validation to incident response only when internal telemetry or independently cited evidence supports the transition.

Incident Response & Containment Decision Plan

Public threat intelligence alone does not establish an internal incident. If internal evidence confirms relevance, preserve evidence, scope affected assets and identities, contain the validated path, eradicate the supported cause, recover, and verify recurrence controls.

Remediation & Validation Plan

• Remediation state from the normalized record: Availability not established in the source record — verify vendor guidance.
• Apply vendor/CISA remediation only when that action is actually present in trusted evidence; otherwise obtain the authoritative remediation source before changing production systems.
• After change, verify asset/version state, exposure path, relevant telemetry, and rollback readiness rather than assuming the change succeeded.

Executive Decision Matrix

• No internal exposure evidence: retain as intelligence, document the negative exposure basis, and continue collection.
• Exposure confirmed but compromise unconfirmed: prioritize supported remediation and heightened telemetry while avoiding unsupported incident claims.
• Internal malicious activity confirmed: activate the organization's incident-response process using the preserved evidence and scoped telemetry.

Executive Recommendations

• Validate enterprise relevance to the technology or service named in the cited record before treating the public record as a customer-specific finding.
• Prioritize evidence-backed remediation, telemetry coverage, and verification over severity labels alone.
• Keep unresolved exploitation, attribution, breach scope, and impact statements explicitly unresolved until corroborating evidence exists.

Intelligence Gaps & Collection Requirements

• Customer-specific exposure is not established by the public source record.
• Customer-specific compromise or impact is not established unless internal telemetry is supplied.
• Any source dimension not represented in the normalized evidence graph requires additional authoritative collection before it can drive a material claim.

Analytic Confidence & Limitations

Confidence is bounded by source reliability, information credibility, corroboration state, and unresolved contradictions already computed by ReportX. Structural compilation never raises epistemic confidence.

Forecast & Outlook

No new future event is predicted by the compiler. Forecast statements, when present in the preserved analytical body, must remain tied to ReportX supporting observation claims and explicit confidence rationale.

References

• CYBERDUDEBIVASH — https://blog.cyberdudebivash.in/posts/cve-2026-72793-go-github-com-siyuan-note-siyuan-kernel.html