Security readout for executives and security teams
Plain-English summary
SiYuan before 3.7.4 can reveal secrets through a configuration API to anonymous or publish-reader users. Those secrets may enable account impersonation, session-cookie tampering, and exposure of encrypted-notebook key material. Systems without access-auth codes face the greatest risk because an attacker may gain administrator privileges.
Executive priority
Treat this as an immediate remediation item for reachable SiYuan deployments. Prioritize systems without access-auth codes, externally accessible systems, and environments containing sensitive notebooks. Assume exposed signing or notebook keys may require rotation until investigation establishes otherwise.
Technical view
The /api/system/getConf endpoint fails to mask the session-cookie signing key, encrypted-notebook key material, and an OS username exposed through the pandoc path. A remote attacker may retrieve these values without full authentication. The reported CVSS 4.0 score is 9.2, with low-complexity, network-based access requiring no privileges or user interaction.
Likely exposure
Internet- or network-reachable SiYuan instances running versions earlier than 3.7.4 are potentially exposed. Anonymous access and publish-reader accounts provide attack paths. Instances lacking access-auth codes have the clearest documented route to administrator escalation.
Exploitation context
The bundle reports that this CVE is not in KEV and provides no evidence of active exploitation. Exploitation in the wild is therefore unconfirmed, not ruled out. The low-complexity, unauthenticated network path and high-value disclosed secrets make prompt remediation appropriate.
Researcher notes
The supplied evidence identifies disclosure and subsequent impersonation risk but does not establish real-world exploitation. Validate exposure without retaining disclosed secrets. The described OS username disclosure is secondary; session signing and encrypted-notebook key material drive the principal risk.
Mitigation direction
- Upgrade SiYuan to version 3.7.4 or later.
- Limit untrusted network access to SiYuan until the upgrade is complete.
- Configure access-auth codes where operationally appropriate.
- Follow vendor guidance for rotating exposed secrets and invalidating existing sessions.
- Assess encrypted notebooks whose key material may have been disclosed.
Validation and detection
- Inventory every SiYuan instance and confirm its installed version.
- Verify the configuration endpoint no longer returns sensitive fields after upgrading.
- Confirm anonymous and publish-reader access cannot retrieve configuration secrets.
- Review available logs for suspicious requests to /api/system/getConf.
- Confirm access-auth codes are configured on applicable instances.
- Verify vendor-recommended secret rotation and session invalidation were completed.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-522: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-72793 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.2 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N——VulnCheckCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N3.94VulnCheckVulnerability scoring details
Base CVSS 4.0 score
9.2CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Base CVSS 3.1 score
8.6HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- GitHub Security Advisory (GHSA-h4v5-crx2-3cv4)CVE reference, VulnCheck · vendor-advisory
- VulnCheck Advisory: SiYuan before v3.7.4 Information Disclosure via /api/system/getConfCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Insufficiently Protected Credentials
Insufficiently Protected Credentials represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.