Why does GHSA-2qqv-3jgq-vpm9 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-2qqv-3jgq-vpm9?

GHSA-2qqv-3jgq-vpm9 has a CVSS v3 base score of 8.6, published by GitHub Security Advisories.

Which products are affected by GHSA-2qqv-3jgq-vpm9?

GHSA-2qqv-3jgq-vpm9 affects 1 product, including: go/github.com/siyuan-note/siyuan/kernel:\u003c= 3.7.3.

⚠ Withdrawn by GitHub Security Advisories

Withdrawn: September 4, 2026

GHSA-2qqv-3jgq-vpm9CriticalCVSS 8.6Disclosed before NVD

Duplicate Advisory: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key and the OS username to anonymous readers

Vendor

GitHub Security Advisories

Published

August 12, 2026

Last Modified

September 4, 2026

📋 Description

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-h4v5-crx2-3cv4. This link is maintained to preserve external references.

Original Description

SiYuan versions before v3.7.4 fail to mask sensitive configuration fields in the /api/system/getConf endpoint, allowing anonymous or publish-reader users to obtain the session-cookie signing key, OS username via pandoc path, and encrypted-notebook key material. Attackers can forge and tamper with session cookies to impersonate users, and on instances without access-auth codes configured, escalate to administrator privileges.

🎯 Affected products1

go/github.com/siyuan-note/siyuan/kernel:<= 3.7.3

📋 Description

Duplicate Advisory

Original Description

🎯 Affected products1

🔗 References (4)