CVE-2026-113601mediumCWE-862

CVE-2026-113601: fallo de gravedad media en usememos memos

Memos before 0.27.0 Missing Authorization via ActivityService ListActivities/GetActivity

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear memos

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3epss 0.3%
Memos before 0.27.0 contains a missing authorization vulnerability in the ActivityService ListActivities and GetActivity API methods that allows authenticated users to view all users' activity records. Low-privileged attackers can enumerate sequential activity IDs to obtain creator IDs, timestamps, and memo-comment references, including activity on other users' private memos.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Productos afectados
usememos · memos
CVEs relacionadas — usememos memos

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-29030MEDIUMmemos vulnerable to an SSRF in /api/resourceEPSS 1.1%CVE-2024-29029MEDIUMmemos vulnerable to an SSRF in /o/get/imageEPSS 1.1%CVE-2024-29028MEDIUMmemos vulnerable to an SSRF in /o/get/httpmetaEPSS 1.0%CVE-2024-41659HIGHGHSL-2024-034: memos CORS Misconfiguration in server.goEPSS 0.6%CVE-2026-84203HIGHMemos 0.26.0 through 0.30.0 Insufficient Session Expiration on Password ChangeEPSS 0.4%CVE-2026-82476MEDIUMMemos through 0.30.0 SSRF via Omitted CGNAT Address RangeEPSS 0.4%