CVE-2026-74903CWE-400denial-of-service

CVE-2026-74903

Medium · published August 18, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
20.2
In the wild
Unconfirmed
What it is

SiYuan before v3.7.4 contains an insufficient access control vulnerability in the /api/lute/spinBlockDOM endpoint, which is guarded only by CheckAuth middleware instead of CheckAdminRole like its sibling endpoint. Authenticated users with RoleEditor or RoleReader roles can invoke the endpoint to transform arbitrary DOM input, and large payloads cause endpoint starvation through per-path mutex serialization.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00288 · 20.2th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2026-08-18T16:19Z
References (3)
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-3j8q-5c8c-grwm · [email protected]https://www.vulncheck.com/advisories/siyuan-before-insufficient-access-control-via-spinblockdom · [email protected]https://github.com/siyuan-note/siyuan/security/advisories/GHSA-3j8q-5c8c-grwm · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 18 AUG 11:19Z
    SiYuan before v3.7.4 Insufficient Access Control via spinBlockDOM
    cvelistv5