CVE-2026-108727

EdgeEver through 1.108.0 contains a missing authorization vulnerability in the Hono API memo-template routes that allows holders of scoped API tokens to bypass token scope restrictions because template handlers never call requireScopes. Attackers with a token lacking write:memos can save a template and invoke POST /api/v1/templates/:id/use to create memos, and list, modify, or delete templates in the token owner's workspace.

Attackers can bypass token restrictions and perform unauthorized operations such as creating or modifying memos, leading to data integrity breaches and potential information leakage. This may result in unauthorized access to organizational resources.

Update EdgeEver to a version later than 1.108.0 if available, or apply patches that enforce scope checks in template handlers. Regularly audit API tokens and their permissions.