usememos vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-84203 Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user changes their password, allowing attackers to maintain account access.High 8.6 · Sep 1, 2026
• CVE-2026-71272 Memos' webhook dispatch function safeDialContext (internal/webhook/webhook.go) resolves the target hostname via net.DefaultResolver.LookupHost and validates theHigh 8.5 · Aug 5, 2026
• CVE-2026-71271 Memos' webhook URL validation, isReservedIP (internal/webhook/validate.go), checks a candidate IP against a reservedCIDRs list that omits 0.0.0.0/8 and never caHigh 8.5 · Aug 5, 2026
• CVE-2025-65795 Incorrect access control in the /api/v1/user endpoint of usememos memos v0.25.2 allows unauthorized attackers to create arbitrary accounts via a crafted requestHigh 7.5 · Dec 8, 2025
• CVE-2024-21635 Memos is a privacy-first, lightweight note-taking service that uses Access Tokens to authenticate application access.High 7.1 · Nov 14, 2025
• CVE-2025-50738 The Memos application, up to version v0.24.3, allows for the embedding of markdown images with arbitrary URLs.Critical 9.8 · Jul 29, 2025
• CVE-2025-22952 elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, which can be exploited to perforCritical 9.8 · Feb 27, 2025
• CVE-2024-41659 memos is a privacy-first, lightweight note-taking service.High 8.1 · Aug 20, 2024
• CVE-2023-5036 Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.15.1.High 8.8 · Sep 18, 2023
• CVE-2023-4698 Improper Input Validation in GitHub repository usememos/memos prior to 0.13.2.High 7.5 · Aug 31, 2023
• CVE-2023-4697 Improper Privilege Management in GitHub repository usememos/memos prior to 0.13.2.High 8.8 · Aug 31, 2023
• CVE-2023-4696 Improper Access Control in GitHub repository usememos/memos prior to 0.13.2.Critical 9.8 · Aug 31, 2023
• CVE-2022-4866 Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.Critical 9 · Dec 31, 2022
• CVE-2022-4865 Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.Critical 9 · Dec 31, 2022
• CVE-2022-4844 Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.High 8.8 · Dec 29, 2022
• CVE-2022-4811 Authorization Bypass Through User-Controlled Key vulnerability in usememos usememos/memos.This issue affects usememos/memos before 0.9.1.High 8.3 · Dec 28, 2022
• CVE-2022-4809 Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.High 8.8 · Dec 28, 2022
• CVE-2022-4808 Improper Privilege Management in GitHub repository usememos/memos prior to 0.9.1.High 8.8 · Dec 28, 2022
• CVE-2022-4803 Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.High 8.8 · Dec 28, 2022
• CVE-2022-4796 Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.1.High 8.1 · Dec 28, 2022
• CVE-2022-4767 Denial of Service in GitHub repository usememos/memos prior to 0.9.1.High 7.5 · Dec 27, 2022
• CVE-2022-4734 Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository usememos/memos prior to 0.9.1.High 8.1 · Dec 27, 2022
• CVE-2022-4689 Improper Access Control in GitHub repository usememos/memos prior to 0.9.0.High 8.8 · Dec 23, 2022
• CVE-2022-4688 Improper Authorization in GitHub repository usememos/memos prior to 0.9.0.High 8.8 · Dec 23, 2022
• CVE-2022-4687 Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.0.High 8.1 · Dec 23, 2022