Vulnerability · Published Aug 18, 2026 · Assigned by VulnCheck

CVE-2026-74903SiYuan before v3.7.4 Insufficient Access Control via spinBlockDOM

Medium 4.3

In plain English

A medium-severity uncontrolled resource consumption in siyuan from siyuan-note. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 83.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

SiYuan before v3.7.4 contains an insufficient access control vulnerability in the /api/lute/spinBlockDOM endpoint, which is guarded only by CheckAuth middleware instead of CheckAdminRole like its sibling endpoint. Authenticated users with RoleEditor or RoleReader roles can invoke the endpoint to transform arbitrary DOM input, and large payloads cause endpoint starvation through per-path mutex serialization.

Affected products (as reported)

Vendor	Product	Versions
siyuan-note	siyuan	0 – before 3.7.4

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

GitHub Security Advisory (GHSA-3j8q-5c8c-grwm) vendor-advisory
VulnCheck Advisory: SiYuan before v3.7.4 Insufficient Access Control via spinBlockDOM third-party-advisory