SiYuan before version 3.7.4 contains an access‑control flaw on the /api/lute/spinBlockDOM endpoint. The endpoint is protected only by generic authentication instead of an administrator‑only check, allowing any authenticated user that holds RoleEditor or RoleReader privileges to submit arbitrary DOM content for transformation. The transformation can alter document data and, because the endpoint processes large payloads in a serialized, per‑path mutex fashion, can be abused to starve the service and cause denial of service for legitimate users. The vulnerability does not provide a straightforward remote code execution path, but it enables unauthorized manipulation of content and can degrade availability. The CVSS score of 5.3 reflects a moderate severity that balances the impact of privilege escalation with the fact that the attacker must already be authenticated.

Siyuan Note (siyuan-note) is the affected product. All releases prior to version 3.7.4 are impacted. Users running any older build of Siyuan should consider the vendor‑supplied upgrade to be available for remediation.

The vulnerability is most easily exploited by an authenticated user with editor or reader privileges, which is common in many setups. Because the flaw relies on misconfigured internal authentication, no external network exposure is required. The EPSS score is not available, and the issue is not listed in CISA KEV, suggesting it is not a widely known or actively exploited vulnerability at this time. However, the design flaw poses a moderate risk; attackers can exploit the inadequate access control to modify documents and can also trigger a DoS condition by flooding the endpoint with large request payloads. The impact remains low to moderate unless an organization maps breadth of user roles or hosts a large site where availability is critical. This scenario aligns with the assessed CVSS score of 5.3.