Usememos vulnerabilities
We track 8 vulnerabilities in Usememos products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on September 1, 2026.
Latest Usememos vulnerabilities
- 8.1 High severity
Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user changes their…
Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user changes their password, allowing attackers to maintain account access. An attacker with a stolen refresh token can call the RefreshToken RPC to obtain new access tokens and rotate t
- 8.5 High severity
memos: Time-of-check Time-of-use (TOCTOU) Race Condition
Memos' webhook dispatch function safeDialContext (internal/webhook/webhook.go) resolves the target hostname via net.DefaultResolver.LookupHost and validates the resulting IPs against reserved ranges, but then dials net.JoinHostPort(host, port) using the origin
- 8.5 High severity
memos: Server-Side Request Forgery
Memos' webhook URL validation, isReservedIP (internal/webhook/validate.go), checks a candidate IP against a reservedCIDRs list that omits 0.0.0.0/8 and never calls ip.IsUnspecified — unlike the correctly implemented sibling function isInternalIP in internal/ht
- 7.5 High severity
Memos: Improper Access Control
Incorrect access control in the /api/v1/user endpoint of usememos memos v0.25.2 allows unauthorized attackers to create arbitrary accounts via a crafted request.
- 7.5 High severity
memos: Improper Authentication
Memos is a privacy-first, lightweight note-taking service that uses Access Tokens to authenticate application access. When a user changes their password, the existing list of Access Tokens stay valid instead of expiring. If a user finds that their account has
- 9.8 Critical severity
Memos: Exposure of Sensitive Information to an Unauthorized Actor
The Memos application, up to version v0.24.3, allows for the embedding of markdown images with arbitrary URLs. When a user views a memo containing such an image, their browser automatically fetches the image URL without explicit user consent or interaction bey
- 9.8 Critical severity
Memos: Server-Side Request Forgery
elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, which can be exploited to perform SSRF attacks.
- 8.1 High severity
memos: Permissive Cross-domain Security Policy with Untrusted Domains
memos is a privacy-first, lightweight note-taking service. A CORS misconfiguration exists in memos 0.20.1 and earlier where an arbitrary origin is reflected with Access-Control-Allow-Credentials set to true. This may allow an attacking website to make a cross-