CVE-2026-72794

CVE-2026-72794 is a session signing key exposure in siyuan's publish mode. The `/api/system/getConf` endpoint returns the cookie signing key to unauthenticated users when publish mode is enabled, allowing complete session forgery for any user — admin, regular, or future. The CVSS 8.6 is warranted, but the EPSS of 0.00249 masks what actually makes this vulnerability dangerous: it's not about whether attackers have discovered the endpoint yet, it's about what happens once they do. A signing key exposed through a configuration endpoint doesn't give you one authentication bypass — it gives you permanent capability to forge sessions for every user, indefinitely, as long as that key remains in rotation. That's a blast radius that doesn't close over time like a typical vulnerability window; it stays open until you rotate the key AND invalidate all existing sessions AND confirm the key wasn't exfiltrated to a persistent store. Patching the endpoint without key rotation leaves you still exposed. More importantly, examine why publish mode exists in its current form at all. This feature almost certainly was designed for a single-user or local-only threat model — perhaps physical-access scenarios — that no longer matches how siyuan is deployed on networked servers. The deployment reality has outgrown the security model, but the feature didn't adjust. When a configuration mode can only be used safely by violating the principle of least privilege, that's a signal that the feature belongs to an obsolete version of the product. For defenders: patch the endpoint immediately, rotate the signing key, invalidate all existing sessions, and treat publish mode as a deprecated architectural pattern that needs redesign — not a feature to be used in production environments with network exposure.

Reviewed through automated stages and approved by a human before publication.