CVE-2024-41659: high-severity vulnerability in usememos memos
GHSL-2024-034: memos CORS Misconfiguration in server.go
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.1epss 0.6%
memos is a privacy-first, lightweight note-taking service. A CORS misconfiguration exists in memos 0.20.1 and earlier where an arbitrary origin is reflected with Access-Control-Allow-Credentials set to true. This may allow an attacking website to make a cross-origin request, allowing the attacker to read private information or make privileged changes to the system as the vulnerable user account. This vulnerability is fixed in 0.21.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Affected products
usememos · memosRelated CVEs — usememos memos
In the same product, most dangerous first.
CVE-2024-29030MEDIUMmemos vulnerable to an SSRF in /api/resourceEPSS 1.1%CVE-2024-29029MEDIUMmemos vulnerable to an SSRF in /o/get/imageEPSS 1.1%CVE-2024-29028MEDIUMmemos vulnerable to an SSRF in /o/get/httpmetaEPSS 1.0%CVE-2026-84203HIGHMemos 0.26.0 through 0.30.0 Insufficient Session Expiration on Password ChangeEPSS 0.4%CVE-2026-82476MEDIUMMemos through 0.30.0 SSRF via Omitted CGNAT Address RangeEPSS 0.4%CVE-2026-71271HIGHMemos Webhook SSRF via 0.0.0.0 Reserved-IP BypassEPSS 0.3%