Siyuan <= 0.0.0-20260313024916-fd6526133bb3 Vulnerability: Early Warning
- Severity
- HIGH
- Affected component
- siyuan (go)
- Affected versions
- <= 0.0.0-20260313024916-fd6526133bb3
- Patched version
- v3.7.4
Siyuan versions before v3.7.4 reportedly expose the session cookie signing key to unauthenticated users in publish mode. This could allow attackers to forge valid session cookies and gain unauthorized access.
What happened
Siyuan versions before v3.7.4 appear to expose the session cookie signing key through the /api/system/getConf endpoint to unauthenticated users in publish mode. This vulnerability, tracked as GHSA-HG4J-W33M-P7G4 and GHSA-34FJ-MWM6-FJFG, allows attackers to retrieve the CookieKey value and forge valid session cookies. This could enable impersonation of users or gaining administrative access. The issue is under investigation and has not been exploited in the wild as of the latest reports.
The affected component is siyuan (go) with versions <= 0.0.0-20260313024916-fd6526133bb3. The vulnerability has been patched in version v3.7.4. Users are advised to upgrade to this version or later to mitigate the risk of session cookie forgery.
What to do about it
- Upgrade siyuan to version v3.7.4 or later to mitigate the risk of session cookie forgery.
- Ensure that your siyuan instance is not in publish mode if an immediate upgrade is not possible.
- Monitor the primary sources for updates on this vulnerability.
- Review your access controls and session management practices to ensure they align with security best practices.
How 0Day would have caught this
siyuan is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using siyuan (go) with versions <= 0.0.0-20260313024916-fd6526133bb3.
What should I do right now?
Upgrade to siyuan v3.7.4 or later to mitigate the risk of session cookie forgery.
Has this been exploited in the wild?
There are no reports of this vulnerability being exploited in the wild as of the latest information.