CVE-2026-72793: SiYuan Non-administrator Responses From /api/system/getConf Omit Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-h4v5-crx2-3cv4",
  "modified" : "2026-09-04T21:16:48Z",
  "published" : "2026-09-04T21:16:48Z",
  "aliases" : [ "CVE-2026-72793" ],
  "summary" : "SiYuan: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key and the OS username to anonymous readers",
  "details" : "**CVE:** This vulnerability corresponds to [CVE-2026-72793](https://nvd.nist.gov/vuln/detail/CVE-2026-72793).\n\n### Summary\n\n`/api/system/getConf` is registered with `CheckAuth` only and is reachable by the publish `RoleReader` token, and anonymously when `Publish.Auth.Enable` is `false`. Its non-administrator masking chain is a blocklist that enumerates fields individually. Three fields that the configuration-export endpoint in the same file deliberately clears are absent from that blocklist and are returned to readers:\n\n| Field | JSON | What it is | Cleared by `exportConf` at |\n|---|---|---|---|\n| `Conf.CookieKey` | `cookieKey` | The session-cookie signing key | `kernel/api/system.go:360` |\n| `Conf.Export.PandocBin` | `export.pandocBin` | Absolute path embedding the OS username | `kernel/api/system.go:338` |\n| `Conf.NotebookCrypto` | `notebookCrypto` | Encrypted-notebook key material | `kernel/api/system.go:360` |\n\nThe project has already classified all three as values that must not leave the server. The reader-facing path returns them.\n\n### Details\n\n**Route.** `kernel/api/router.go:70` : `POST /api/system/getConf` → `model.CheckAuth` → `getConf`. No `CheckReadonly`, no `CheckAdminRole`.\n\n**The masking chain, and what each stage covers.** `getConf` masks through `GetMaskedConf()` → `HideConfSecret()` (non-administrators) → `FilterConfByPublishIgnore()` (readers) → a browser-request path strip.\n\n- `GetMaskedConf`: `UserData`, `MCPOAuth`, `AccessAuthCode`.\n- `HideConfSecret`: `AI`, `Api`, `Flashcard`, `ServerAddrs`, `Publish`, `Repo`, `Sync`, `Secrets`, `Variables`, and the System paths. No reference to `CookieKey` or `Export.PandocBin`.\n- `FilterConfByPublishIgnore`: `UILayout` only.\n- Browser strip (`kernel/api/system.go:630-631`): System paths only.\n\nEach stage names fields explicitly, so any field nobody thought to add is returned by default.\n\n---\n\n**1. `CookieKey`: the live session-signing key.**\n\nThe value is passed straight into the session store at startup:\n\n```\ncli/cmd/serve.go:67          go server.Serve(false, model.Conf.CookieKey)\nkernel/server/serve.go:152   sessionStore = cookie.NewStore([]byte(cookieKey))\nkernel/server/serve.go:159   ginServer.Use(sessions.Sessions(\"siyuan\", sessionStore))\n```\n\n`gin-contrib/sessions/cookie.NewStore` constructed with a single key uses that key as the `gorilla/securecookie` HMAC key. The `siyuan` session cookie is signed with the value this endpoint hands out, so an attacker holding it can mint and modify session cookies the server accepts as authentic.\n\nEscalating a forged session to administrator additionally requires the forged `SessionData` to carry the matching `AccessAuthCode` which *is* masked or the instance to have no access-auth code configured, which is a common deployment. The unconditional impact, present on every instance, is disclosure of a persistent cryptographic secret to an unauthenticated party. Rotating it invalidates every active session, so it cannot be quietly refreshed.\n\n---\n\n**2. `Export.PandocBin`: bypasses a shipped privacy control.**\n\nThe field is an absolute path that embeds the OS username by construction:\n\n```\nconf/export.go:35        PandocBin string `json:\"pandocBin\"`\nmodel/conf.go:430-431    if \"\" == Conf.Export.PandocBin { Conf.Export.PandocBin = util.PandocBinPath }\nutil/pandoc.go:154       PandocBinPath = filepath.Join(tempPandocDir, \"bin\", \"pandoc.exe\")\nutil/pandoc.go:134       tempPandocDir = filepath.Join(TempDir, \"pandoc\")\nutil/working.go:359      TempDir = filepath.Join(WorkspaceDir, \"temp\")\nutil/working.go:312      defaultWorkspaceDir = filepath.Join(userProfile, \"SiYuan\")\n```\n\n→ `C:\\Users\\<username>\\SiYuan\\temp\\pandoc\\bin\\pandoc.exe`\n\nThis one is notable beyond the disclosure itself, because a control was shipped specifically to prevent it. `kernel/api/system.go:630` adds, for browser requests:\n\n```go\nif util.IsBrowserRequest(c) {\n    maskedConf.System.WorkspaceDir = \"\"\n    maskedConf.System.AppDir = \"\"\n    maskedConf.System.ConfDir = \"\"\n    maskedConf.System.DataDir = \"\"\n    maskedConf.System.HomeDir = \"\"\n}   // 避免泄露用户名等敏感信息\n```\n\nThe comment states the goal plainly: avoid leaking the username and other sensitive information. The block enumerates only `System.*` and misses `Export.PandocBin`, which carries the same username through the same response. A publish reader is a browser request, so the System paths are blanked while `export.pandocBin` passes through intact. Where an administrator has configured a custom pandoc location, that path is disclosed instead still a filesystem-layout disclosure.\n\n---\n\n**3. `NotebookCrypto`.** Encrypted-notebook key material is likewise absent from `HideConfSecret` while `exportConf` sets it to `nil`. Reported previously and included here only because it is the third instance of the same root cause; the fix below closes all three together.\n\n---\n\n**The root cause is the blocklist itself.** `exportConf` (`kernel/api/system.go:299`) clones the configuration and clears each secret before returning it `CookieKey`, `NotebookCrypto`, `Export.PandocBin`, `Account`, `Stat`, `System.ID`, the AI keys. That cloner is the project's own working inventory of what must not leave the server. `getConf`'s non-administrator path maintains a separate, shorter list that has now diverged from it in three places. Any future secret added to the config will default to exposed on the reader path unless someone remembers to extend the blocklist.\n\n### Proof of Concept\n\nPrecondition: publish mode enabled (default port 6808); anonymous when `Publish.Auth.Enable` is `false`, otherwise any publish reader account.\n\n```\nPOST http://127.0.0.1:6808/api/system/getConf\n{}\n\n→ 200. The conf object contains:\n     cookieKey          — the session-signing key, cleartext\n     export.pandocBin   — absolute path containing the OS username\n     notebookCrypto     — encrypted-notebook key material\n```\n\nDifferential check against the endpoint that strips them, same instance:\n\n```\nPOST http://127.0.0.1:6808/api/system/exportConf\n\n→ cookieKey is empty, export.pandocBin is empty, notebookCrypto is null\n```\n\nThe same three values are withheld by one endpoint and returned by the other.\n\n### Impact\n\nAn anonymous reader in publish mode or any publish `RoleReader` obtains the server's session-cookie signing key, permitting forgery and tampering of session cookies the server validates as authentic, with administrator authentication reachable on instances that have no access-auth code configured. The same response discloses the operating-system username and workspace layout, defeating a control added specifically to prevent that disclosure, and encrypted-notebook key material.\n\n### Suggested fix\n\nRoute non-administrator `getConf` responses through the `exportConf` cloner rather than extending `HideConfSecret` field by field. The cloner already handles every field named here and is the list the project actually maintains; keeping two divergent inventories of the same secrets is what produced all three gaps. If a targeted patch is preferred in the interim, clear `CookieKey` and `NotebookCrypto` in `HideConfSecret` and add `Export.PandocBin` to the `IsBrowserRequest` block, then audit the config struct for any remaining absolute-path or secret-bearing field.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/siyuan-note/siyuan/kernel"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.0.0-20260725132049-2d8b98395a91"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-h4v5-crx2-3cv4"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-72793"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/siyuan-note/siyuan/commit/2d8b98395a910251aea87e90a4fad9c7f954befe"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/siyuan-note/siyuan"
  }, {
    "type" : "WEB",
    "url" : "https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-api-system-getconf"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-522" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-09-04T21:16:48Z",
    "nvd_published_at" : null
  }
}