CVE-2026-82476

MEDIUM 5.3

Memos through 0.30.0 SSRF via Omitted CGNAT Address Range

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

Memos through 0.30.0 omits the 100.64.0.0/10 carrier-grade NAT address range from SSRF protection in its link-metadata fetcher, allowing unauthenticated attackers to bypass IP validation. Attackers can make the server request internal hosts in that range including cloud metadata services and read page titles and descriptions back.

CWE	CWE-918
Vendor	usememos
Product	memos
Published	Aug 29, 2026

Stay Ahead of the Next One

Get instant alerts for usememos memos

Be the first to know when new medium vulnerabilities affecting usememos memos are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

usememos / memos

0 ≤ 0.30.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/usememos/memos/issues/6099 github.com: https://github.com/usememos/memos/blob/v0.30.0/internal/httpgetter/html_meta.go github.com: https://github.com/usememos/memos vulncheck.com: https://www.vulncheck.com/advisories/memos-through-0.30.0-ssrf-via-omitted-cgnat-address-range

Credits

George Chen