CVE-2026-51583
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
An issue in usememos through v0.30.0 allows a remote authenticated attacker to perform Server-Side Request Forgery (SSRF) via the Webhook validation mechanism in internal/webhook/validate.go, by setting a webhook target to an internal address.
Risk Assessment
An attacker can access internal network resources, potentially leading to disclosure of sensitive information or further attacks.
Recommendation
Update usememos to a version that blocks internal addresses in webhook validation, or apply a relevant patch.
Original NVD description (English source)
An issue in usememos through v0.30.0 allows a remote authenticated attacker to perform Server-Side Request Forgery (SSRF) via the Webhook validation mechanism in internal/webhook/validate.go, by setting a webhook target to an internal address.