CVE-2026-51583

EUVD-2026-56176
An issue in usememos through v0.30.0 allows a remote authenticated attacker to perform Server-Side Request Forgery (SSRF) via the Webhook validation mechanism in internal/webhook/validate.go, by setting a webhook target to an internal address.
SSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.5 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 31.41%
Common Weakness Enumeration
References
https://gist.github.com/seiyaibuki0523/d8af15eb555808319a2633269a9ebb80
https://github.com/usememos/memos
https://gist.github.com/seiyaibuki0523/d8af15eb555808319a2633269a9ebb80