CVE-2026-113601

MEDIUM 4.3

Memos before 0.27.0 Missing Authorization via ActivityService ListActivities/GetActivity

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

Memos before 0.27.0 contains a missing authorization vulnerability in the ActivityService ListActivities and GetActivity API methods that allows authenticated users to view all users' activity records. Low-privileged attackers can enumerate sequential activity IDs to obtain creator IDs, timestamps, and memo-comment references, including activity on other users' private memos.

CWE	CWE-862
Vendor	usememos
Product	memos
Published	Oct 20, 2026

Stay Ahead of the Next One

Get instant alerts for usememos memos

Be the first to know when new medium vulnerabilities affecting usememos memos are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

usememos / memos

0 < 0.27.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/usememos/memos/issues/5651 github.com: https://github.com/usememos/memos/commit/04f239a2fc74f7090c779a6a7b8a08238fd31b88 github.com: https://github.com/usememos/memos/releases/tag/v0.27.0 github.com: https://github.com/usememos/memos/blob/v0.26.2/server/router/api/v1/activity_service.go vulncheck.com: https://www.vulncheck.com/advisories/memos-before-0.27.0-missing-authorization-via-activityservice-listactivities-getactivity

Credits

lighthousekeeper1212 🔍 leediay153 from Viettel Post