Description

SiYuan before v3.7.4 contains an insufficient access control vulnerability in the /api/lute/spinBlockDOM endpoint, which is guarded only by CheckAuth middleware instead of CheckAdminRole like its sibling endpoint. Authenticated users with RoleEditor or RoleReader roles can invoke the endpoint to transform arbitrary DOM input, and large payloads cause endpoint starvation through per-path mutex serialization.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-18T12:19:30.507Z",
  "pubdate": "2026-08-18T12:19:30.507Z",
  "executiveSummary": "An insufficient access control vulnerability exists in SiYuan prior to version v3.7.4 within the /api/lute/spinBlockDOM endpoint.\nThe vulnerability allows authenticated users assigned with restricted privileges, specifically RoleEditor or RoleReader roles, to invoke functionality intended for higher-privilege administrative roles.\nThe root cause stems from improper authorization enforcement, utilizing only the baseline CheckAuth middleware rather than the requisite CheckAdminRole security control applied to sibling administrative endpoints.\nAttackers capable of authenticating with low-privileged roles can exploit this flaw by submitting arbitrary Document Object Model (DOM) inputs to the targeted endpoint.\nFurthermore, the inclusion of large payloads leverages per-path mutex serialization mechanisms implemented within the application architecture, causing resource contention and endpoint starvation.\nThis introduces significant availability risks, effectively facilitating Denial of Service (DoS) conditions against the underlying service.\nThe impact encompasses unauthorized function execution and potential application-wide performance degradation or complete service unresponsiveness due to thread or mutex locking bottlenecks.",
  "technicalDetails": "The vulnerability resides in the /api/lute/spinBlockDOM endpoint of SiYuan prior to version v3.7.4, which acts as a processing handler for DOM transformations.\nFrom an architectural perspective, the access control implementation for this specific endpoint fails to enforce administrative privileges properly.\nWhile comparable administrative endpoints correctly enforce the CheckAdminRole middleware to restrict access strictly to privileged users, /api/lute/spinBlockDOM is governed solely by the weaker CheckAuth middleware.\nConsequently, any authenticated user possessing low-privileged roles, such as RoleEditor or RoleReader, can successfully pass authentication checks and interact with the vulnerable handler.\nThe exploitation method involves the targeted transmission of HTTP requests to the /api/lute/spinBlockDOM endpoint containing malicious or arbitrarily crafted DOM input payloads.\nUpon receiving the request, the application processes the input data through its internal rendering and transformation logic without proper authorization verification.\nIn addition to unauthorized capability execution, the attack flow supports systemic resource exhaustion.\nThe endpoint architecture employs per-path mutex serialization to manage concurrent invocations and protect shared state during DOM processing operations.\nWhen an attacker supplies excessively large payloads designed to maximize processing duration, the per-path mutex serializes execution requests, forcing concurrent legitimate and malicious threads to queue sequentially.\nThis serialization bottleneck leads to endpoint starvation, resource exhaustion, and subsequent Denial of Service (DoS) conditions impacting all users relying on the application.\nPrerequisites for exploitation include network accessibility to the application interface and valid low-privileged authentication credentials corresponding to RoleEditor or RoleReader assignments."
}