CVE-2025-65798
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
In usememos memos version 0.25.2, incorrect access control allows attackers with low-level privileges to arbitrarily modify or delete attachments created by other users.
Risk Assessment
The organization faces data integrity loss and potential confidentiality breaches, as attackers can manipulate other users' attachments, potentially leading to leakage or destruction of important information.
Recommendation
Immediately update usememos memos to the latest version containing a fix for this vulnerability, and review and adjust access permissions for attachments.
Other vulnerabilities in usememos memos
See all- CVE-2025-65799Medium
In the Attachment service of usememos memos v0.25.2, a lack of file name validation allows attackers to perform a path traversal. This vulnerability enables access to files outside the intended directory.
- CVE-2025-65797Medium
An incorrect access control vulnerability in the Identity Provider service of usememos memos v0.25.2 allows low-privileged attackers to arbitrarily modify or delete registered identity providers. This can lead to account takeover or Denial of Service (DoS).
- CVE-2025-65795High
An incorrect access control vulnerability in usememos memos v0.25.2 allows unauthorized attackers to create arbitrary accounts via a crafted request to the /api/v1/user endpoint.
- CVE-2025-65796Medium
In usememos memos version 0.25.2, an incorrect access control allows attackers with low-level privileges to arbitrarily delete reactions made to other users' Memos.
- CVE-2023-4698High
Improper input validation exists in the GitHub repository usememos/memos prior to version 0.13.2.
- CVE-2023-4697High
Improper Privilege Management exists in the GitHub repository usememos/memos prior to version 0.13.2.
Original NVD description (English source)
Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify or delete attachments made by other users.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS