CVE-2026-74903
MediumCVSS 4.3Summary
SiYuan before v3.7.4 contains an insufficient access control vulnerability in the /api/lute/spinBlockDOM endpoint, which is guarded only by CheckAuth middleware instead of CheckAdminRole like its sibling endpoint. Authenticated users with RoleEditor or RoleReader roles can invoke the endpoint to transform arbitrary DOM input, and large payloads cause endpoint starvation through per-path mutex serialization.
Risk Assessment
The risk is unauthorized access to DOM transformation functionality, which can lead to content modification or DoS attacks. Users with restricted roles can exploit the vulnerability to disrupt service.
Recommendation
It is recommended to upgrade SiYuan to version v3.7.4 or later, which includes the fix. Also review access control for endpoints to ensure they require appropriate roles.
Original NVD description (English source)
SiYuan before v3.7.4 contains an insufficient access control vulnerability in the /api/lute/spinBlockDOM endpoint, which is guarded only by CheckAuth middleware instead of CheckAdminRole like its sibling endpoint. Authenticated users with RoleEditor or RoleReader roles can invoke the endpoint to transform arbitrary DOM input, and large payloads cause endpoint starvation through per-path mutex serialization.