Insufficient Access Control in SiYuan by SiYuan Team

CVE-2026-74903

What is CVE-2026-74903?

An insufficient access control vulnerability exists in SiYuan versions prior to v3.7.4 at the /api/lute/spinBlockDOM endpoint. This endpoint relies solely on CheckAuth middleware, allowing authenticated users with RoleEditor or RoleReader roles to access it, unlike its secure counterpart. This misconfiguration enables these users to manipulate arbitrary DOM inputs, leading to potential security risks. Additionally, larger payloads sent to this endpoint can cause endpoint starvation due to per-path mutex serialization, significantly impacting system performance and availability.

References