CVE-2026-74903: SiYuan before v3.7.4 Insufficient Access Control via spinBlockDOM
SiYuan before v3.7.4 contains an insufficient access control vulnerability in the /api/lute/spinBlockDOM endpoint, which is guarded only by CheckAuth middleware instead of CheckAdminRole like its sibling endpoint. Authenticated users with RoleEditor or RoleReader roles can invoke the endpoint to transform arbitrary DOM input, and large payloads cause endpoint starvation through per-path mutex serialization.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated account assigned the RoleEditor or RoleReader role can reach the affected endpoint. The issue does not require administrator privileges.
What is required to exploit the vulnerability?
An attacker needs valid credentials for a RoleEditor or RoleReader account and network access to the SiYuan instance. They can submit arbitrary DOM input to /api/lute/spinBlockDOM, and large payloads can starve the endpoint because requests are serialized by a per-path mutex.
What should we do to remediate the issue?
Upgrade SiYuan to v3.7.4 or later. The provided data does not identify another mitigation for deployments that cannot patch immediately.