CyberRota Analysis
AI-GeneratedThe vulnerability affects SiYuan versions prior to 3.7.4, specifically in the /api/lute/spinBlockDOM endpoint, which lacks proper access control by only using CheckAuth instead of CheckAdminRole. This allows authenticated users with RoleEditor or RoleReader roles to manipulate arbitrary DOM input, potentially leading to denial-of-service conditions due to endpoint starvation from large payloads. Organizations using SiYuan should prioritize patching this vulnerability to mitigate risks associated with unauthorized access and service disruption.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SiYuan before v3.7.4 contains an insufficient access control vulnerability in the /api/lute/spinBlockDOM endpoint, which is guarded only by CheckAuth middleware instead of CheckAdminRole like its sibling endpoint. Authenticated users with RoleEditor or RoleReader roles can invoke the endpoint to transform arbitrary DOM input, and large payloads cause endpoint starvation through per-path mutex serialization.