SiYuan CVE-2026-74903

Exploitation requires a valid authenticated session for the SiYuan instance - specifically, an account holding the RoleEditor or RoleReader role (not just admin). The SiYuan API must be network-reachable from the attacker's position (AV:N per CVSS). No special feature flag or non-default configuration is required beyond having non-admin authenticated users in the system, which is a common deployment pattern for collaborative SiYuan workspaces. Exploitation is limited by the authentication prerequisite: unauthenticated external attackers cannot reach the endpoint. Instances deployed as single-user, localhost-only installations with no additional accounts are not realistically exposed. Internet-exposed instances with open or shared user accounts present the highest realistic exposure.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network exploitation with low complexity and low privileges, consistent with the description. However, the provided vector records VA:N (no availability impact on the vulnerable system) despite the description explicitly describing endpoint starvation through per-path mutex serialization - this is a discrepancy that should be verified with the vendor, as the DoS component appears to be the primary realized harm. The integrity metric VI:L reflects unauthorized DOM transformation capability. No EPSS data was provided, and the vulnerability is not listed in CISA KEV, so there is no signal of active or widespread exploitation. The real-world risk is moderate and bounded: SiYuan is typically self-hosted with a small, trusted user base, so RoleReader/RoleEditor access is unlikely to be held by an adversary unless the instance is exposed externally with open registration or compromised credentials. Organizations running internet-facing SiYuan with multiple untrusted authenticated users face the most realistic exposure. The absence of a POC and the niche deployment footprint further limit practical risk despite the medium-severity CVSS rating.

An authenticated SiYuan user - for example, a workspace collaborator granted RoleReader access - submits a series of crafted HTTP POST requests with oversized DOM payloads to /api/lute/spinBlockDOM. Each large request acquires the per-path mutex and holds it for the duration of processing, queuing subsequent requests and starving the endpoint for all users. No public exploit code has been identified at time of analysis, but the attack requires only a valid session token and knowledge of the endpoint path.