CVE-2026-74903: SiYuan Authentication Bypass Vulnerability

CVE-2026-74903 Overview

SiYuan versions before v3.7.4 contain an insufficient access control vulnerability in the /api/lute/spinBlockDOM endpoint. The endpoint is guarded only by CheckAuth middleware rather than CheckAdminRole, which protects its sibling endpoints. Authenticated users holding RoleEditor or RoleReader roles can invoke the endpoint to transform arbitrary DOM input. Large payloads trigger endpoint starvation because per-path mutex serialization blocks concurrent requests. The flaw is tracked under CWE-400: Uncontrolled Resource Consumption.

Critical Impact

Low-privilege authenticated users can degrade availability of the SiYuan note-taking service by submitting oversized DOM payloads that serialize behind a per-path mutex.

Affected Products

• SiYuan note-taking application versions prior to v3.7.4
• Deployments exposing the /api/lute/spinBlockDOM API endpoint
• Multi-user SiYuan instances granting RoleEditor or RoleReader accounts

Discovery Timeline

• 2026-08-18 - CVE-2026-74903 published to NVD
• 2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-74903

Vulnerability Analysis

SiYuan exposes a REST API surface protected by role-based middleware. The /api/lute/spinBlockDOM endpoint accepts DOM content and returns a transformed representation using the Lute Markdown engine. The endpoint should require administrator privileges, matching the protection applied to its sibling routes. Instead, it uses the generic CheckAuth middleware, which admits any authenticated session.

The secondary issue is a resource exhaustion condition. Requests are serialized behind a per-path mutex, meaning only one spinBlockDOM call can execute at a time. An authenticated attacker submitting large DOM payloads holds the mutex for extended periods, starving legitimate requests to the same endpoint.

Root Cause

The root cause is a middleware misconfiguration. The route registration attaches CheckAuth instead of CheckAdminRole, breaking the least-privilege model enforced elsewhere in the Lute API family. Combined with per-path mutex serialization and no size limit on inbound DOM, the endpoint becomes a denial-of-service primitive available to non-administrative accounts.

Attack Vector

Exploitation requires network access to the SiYuan API and valid credentials for a RoleEditor or RoleReader account. The attacker sends HTTP POST requests carrying oversized DOM payloads to /api/lute/spinBlockDOM. Each request holds the endpoint mutex while the Lute engine parses and transforms the input, blocking concurrent operations and degrading service availability for other users.

No authenticated administrator interaction is required. See the GitHub Security Advisory GHSA-3j8q-5c8c-grwm and the VulnCheck Advisory for additional technical detail.

Detection Methods for CVE-2026-74903

Indicators of Compromise

• Repeated HTTP POST requests to /api/lute/spinBlockDOM from non-admin session tokens.
• Anomalously large request bodies (multi-megabyte payloads) targeting the Lute API family.
• Increased latency and 5xx responses on /api/lute/* endpoints coinciding with sustained inbound traffic.

Detection Strategies

• Baseline normal request sizes to /api/lute/spinBlockDOM and alert on payloads exceeding that baseline.
• Correlate the requesting session's role (RoleEditor, RoleReader) against endpoint access to surface calls that should require administrator privileges.
• Track request duration and mutex hold time on Lute API routes to detect serialization stalls.

Monitoring Recommendations

• Forward SiYuan access logs to a centralized logging pipeline and retain full request metadata including user role and body size.
• Alert on request-per-second thresholds and cumulative payload volume per authenticated user against /api/lute/*.
• Monitor process CPU and memory on the SiYuan host for correlation with API traffic bursts.

How to Mitigate CVE-2026-74903

Immediate Actions Required

• Upgrade SiYuan to v3.7.4 or later, which replaces CheckAuth with CheckAdminRole on the affected endpoint.
• Audit accounts holding RoleEditor and RoleReader and revoke unused credentials.
• Restrict inbound network access to trusted clients until the patched version is deployed.

Patch Information

The fix is delivered in SiYuan v3.7.4. The patched build aligns the /api/lute/spinBlockDOM route with its sibling endpoints by applying the CheckAdminRole middleware. Refer to the GitHub Security Advisory GHSA-3j8q-5c8c-grwm for release notes and commit references.

Workarounds

• Place SiYuan behind a reverse proxy that enforces a strict request body size limit on /api/lute/spinBlockDOM.
• Rate-limit requests to /api/lute/* per authenticated user at the proxy layer.
• Temporarily block the /api/lute/spinBlockDOM route at the proxy for non-administrator sessions until patching is complete.

# Example NGINX mitigation: cap body size and rate-limit the vulnerable endpoint
limit_req_zone $binary_remote_addr zone=lute:10m rate=5r/m;

location = /api/lute/spinBlockDOM {
    client_max_body_size 64k;
    limit_req zone=lute burst=2 nodelay;
    proxy_pass http://siyuan_upstream;
}