# SiYuan: The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by /api/system/getConf

SiYuan's /api/system/getConf returns Conf.CookieKey, the session-cookie HMAC signing key, to anonymous publish readers, enabling forged session cookies.

- Payout: Research
- Severity: high
- Program: SiYuan
- Found by (vendor credit): Shirshakhtml
- Found by: Shirshakhtml
- Disclosed: 2026-09-04
- CVE: CVE-2026-72794
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-34fj-mwm6-fjfg
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-34fj-mwm6-fjfg
- Tags: area:web domain:web impact:ato impact:privesc kind:research platform:ghsa sev:high tech:go technique:source-review vuln:auth-bypass vuln:info-disclosure vuln:misconfiguration

**Target:** POST /api/system/getConf HTTP API endpoint
**Root cause:** getConf is registered with CheckAuth only and its masking chain (GetMaskedConf, HideConfSecret, FilterConfByPublishIgnore) never clears AppConf.CookieKey, so the session-signing key reaches non-admin/reader responses.
**Steps:**
1. Enable publish mode (default port 6808) with Publish.Auth.Enable=false, or use any publish RoleReader account.
2. Send `POST http://127.0.0.1:6808/api/system/getConf` with body `{}`.
3. Response 200 conf object contains `cookieKey` in cleartext.
4. Differential: `POST /api/system/exportConf` returns empty cookieKey and null notebookCrypto, confirming the field is treated as secret elsewhere.
**How found:** Code review of router.go and system.go: noticed exportConf explicitly clears CookieKey and NotebookCrypto while getConf's masking chain omits CookieKey, then traced the key into serve.go's session store construction.
**Exploitation:** Attacker obtains the HMAC key used by gin-contrib/sessions cookie.NewStore for the `siyuan` cookie, then mints/modifies session cookies the server accepts as authentic; escalating to admin additionally requires the forged SessionData to carry the matching AccessAuthCode or the instance to have none configured.
**Escalation:** Forged session contents satisfying server checks (e.g. no access-auth code configured) extend the cookie forgery to authenticating as a privileged user.
**Insight:** When a project has an export/clone path that explicitly nulls secrets, diff it against the normal read path's blocklist masking — blocklists fail open on fields nobody added, so any secret cleared in one endpoint but not the other is a leak candidate.