CVE-2026-74903 in SiYuan
Summary
by MITRE • 08/18/2026
SiYuan before v3.7.4 contains an insufficient access control vulnerability in the /api/lute/spinBlockDOM endpoint, which is guarded only by CheckAuth middleware instead of CheckAdminRole like its sibling endpoint. Authenticated users with RoleEditor or RoleReader roles can invoke the endpoint to transform arbitrary DOM input, and large payloads cause endpoint starvation through per-path mutex serialization.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/18/2026
The vulnerability identified in SiYuan versions prior to 3.7.4 represents a critical failure in access control mechanisms within the application's API layer. Specifically, the /api/lute/spinBlockDOM endpoint is inadequately protected by authentication middleware that only verifies user identity without validating administrative privileges. This design flaw stands in stark contrast to sibling endpoints which correctly enforce CheckAdminRole checks, creating an inconsistent security posture across similar functionalities. The core issue lies in the misconfiguration of authorization policies where operations requiring elevated permissions are accessible to standard authenticated users holding RoleEditor or RoleReader roles.
From a technical perspective, this insufficient access control allows non-administrative users to invoke functions intended for system administrators. The endpoint processes arbitrary Document Object Model (DOM) input provided by the client side. While the immediate risk might appear limited to data manipulation, the architectural implementation introduces a significant availability concern. The processing logic utilizes per-path mutex serialization to handle concurrent requests. When an authenticated user with lower privileges submits large or complex DOM payloads, they can trigger extensive computational workloads that lock the specific path's mutex for extended periods.
This mechanism effectively enables a denial of service condition through resource exhaustion and endpoint starvation. Because the mutex is serialized on a per-path basis, a single malicious actor can monopolize the processing thread associated with this API route. This blocks other legitimate users from accessing the same functionality or potentially related services that share underlying resources depending on the server's threading model. The impact extends beyond simple unauthorized data modification to include service degradation for all users relying on SiYuan during the duration of the attack, effectively turning a standard authentication bypass into an availability threat.
In terms of industry standards classification, this vulnerability aligns with CWE-269 Improper Privilege Management and CWE-749 Exposure of Sensitive Information to Unauthorized Actors if the DOM transformation exposes internal state or structure. Furthermore, the exploitation technique involving resource exhaustion through serialized processing maps closely to ATT&CK T1499 Endpoint Denial of Service variants that target application-level resources rather than network bandwidth. The lack of role-based access control enforcement on a privileged endpoint is also indicative of CWE-862 Missing Authorization checks within specific code paths despite the presence of general authentication guards.
Mitigation strategies must prioritize correcting the authorization logic immediately. Developers should update the middleware chain for the /api/lute/spinBlockDOM endpoint to enforce CheckAdminRole, ensuring that only users with explicit administrative privileges can execute DOM transformation operations. Additionally, input validation and size limits should be implemented on all API endpoints accepting large payloads to prevent resource exhaustion attacks regardless of privilege level. Implementing rate limiting or request queuing mechanisms at the web server or application gateway layer can further mitigate starvation risks by preventing any single user from monopolizing processing threads for extended durations. Upgrading to version 3.7.4 or later resolves this issue as it includes these necessary access control corrections and potential performance optimizations.