SiYuan versions prior to 3.7.4 have an access control weakness in the /api/lute/spinBlockDOM endpoint. Unlike a similar endpoint guarded by CheckAdminRole, this endpoint is only protected by CheckAuth middleware, permitting users with RoleEditor or RoleReader privileges to send arbitrary DOM transformation requests. The endpoint processes requests with per-path mutex serialization, so large payloads can cause uncontrolled resource consumption and endpoint starvation. This vulnerability is tracked as CVE-2026-74903 with a CVSS 4.0 score of 5.3 (medium severity).

Authenticated users with limited roles (RoleEditor or RoleReader) can exploit this vulnerability to cause denial of service by sending large payloads to the vulnerable endpoint, resulting in resource exhaustion and endpoint starvation. There is no indication of privilege escalation or data compromise from the provided data.

A fix is available in SiYuan version 3.7.4 and later. Users should upgrade to version 3.7.4 or newer to remediate this vulnerability. Until then, restrict access to the vulnerable endpoint or limit payload sizes if possible. No vendor advisory content was provided to indicate alternative mitigations or if the issue is already mitigated.