CVE-2026-113601

EUVD-2026-105167
Memos before 0.27.0 contains a missing authorization vulnerability in the ActivityService ListActivities and GetActivity API methods that allows authenticated users to view all users' activity records. Low-privileged attackers can enumerate sequential activity IDs to obtain creator IDs, timestamps, and memo-comment references, including activity on other users' private memos.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 15.51%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
usememosmemos
𝑥
< 0.27.0
CNA
Common Weakness Enumeration
References
https://github.com/usememos/memos/blob/v0.26.2/server/router/api/v1/activity_service.go
https://github.com/usememos/memos/commit/04f239a2fc74f7090c779a6a7b8a08238fd31b88
https://github.com/usememos/memos/issues/5651
https://github.com/usememos/memos/releases/tag/v0.27.0
https://www.vulncheck.com/advisories/memos-before-0.27.0-missing-authorization-via-activityservice-listactivities-getactivity