PT-2025-49564 · Unknown · Usememos/Memos

Published 2025-12-08 · Updated 2026-01-06 · CVE-2025-65795

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions usememos memos version 0.25.2

Description A flaw in access control within the /api/v1/user endpoint of usememos memos allows unauthorized account creation through a specially crafted request. The issue allows attackers to bypass intended security measures and create arbitrary accounts. The vulnerable endpoint is /api/v1/user. The request is crafted to exploit the access control weakness.

Recommendations Update usememos memos to a version with corrected access controls for the /api/v1/user endpoint.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-65795

GHSA-MG56-WC4Q-RW4W

GO-2025-4217

SUSE-SU-2026:0037-1

Affected Products

Usememos/Memos

References · 90

• 🔥 https://herolab.usd.de/usd-2025-0058 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-65795 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:0037-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-65795 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-4217 · Vendor Advisory
• https://github.com/usememos/memos/pull/5217 · Note
• https://github.com/usememos/memos/commit/769dcd0cf9be83d472829f6e7903b201e42f6b3c · Note
• http://memos.com · Note
• https://suse.com/security/cve/CVE-2025-68941 · Note
• https://suse.com/security/cve/CVE-2025-67508 · Note
• https://suse.com/security/cve/CVE-2025-10543 · Note
• https://suse.com/security/cve/CVE-2025-60633 · Note
• https://suse.com/security/cve/CVE-2025-68939 · Note
• https://suse.com/security/cve/CVE-2025-65637 · Note
• https://suse.com/security/cve/CVE-2025-66508 · Note