CVE-2026-74903 PUBLISHED

SiYuan before v3.7.4 Insufficient Access Control via spinBlockDOM

Assigner: VulnCheck
Reserved: 17.08.2026 Published: 18.08.2026 Updated: 18.08.2026

SiYuan before v3.7.4 contains an insufficient access control vulnerability in the /api/lute/spinBlockDOM endpoint, which is guarded only by CheckAuth middleware instead of CheckAdminRole like its sibling endpoint. Authenticated users with RoleEditor or RoleReader roles can invoke the endpoint to transform arbitrary DOM input, and large payloads cause endpoint starvation through per-path mutex serialization.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS Score: 5.3

Product Status

Vendor siyuan-note
Product siyuan
Versions Default: unaffected
  • affected from 0 to 3.7.4 (excl.)
  • Version 3.7.4 is unaffected

Credits

  • KushSathwara reporter

References

Problem Types

  • Uncontrolled Resource Consumption CWE