The vulnerability resides in the /api/system/getConf endpoint of SiYuan. The endpoint fails to mask sensitive configuration values, allowing an attacker to read the session cookie signing key, the OS username, and encrypted notebook key material. This exposure permits an attacker to forge session cookies, impersonate legitimate users, and on instances lacking access-auth codes, elevate privileges to administrative level. The weakness is a sensitive data exposure (CWE-522).

SiYuan Note, versions prior to 3.7.4, is affected. The flaw impacts any instance where the /api/system/getConf endpoint is exposed to anonymous or publish‑reader users.

The CVSS base score of 9.2 indicates a high severity. The EPSS score is unavailable, but the vulnerability is not listed in the CISA KEV catalog and no public exploits are documented. The attack requires network access to the instance and the ability to issue a GET request to the /api/system/getConf endpoint. Once the sensitive configuration data is retrieved, an attacker can forge authenticated sessions and, if no access‑auth code is set, assume administrative control. The exploit path is straightforward for anyone with network connectivity to the target.