PT-2025-49566 · Unknown · Usememos/Memos

Published 2025-12-08 · Updated 2026-01-06 · CVE-2025-65797

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions usememos memos version 0.25.2

Description A flaw exists in the Identity Provider service of usememos memos that involves incorrect access control. Attackers with limited privileges can modify or delete registered identity providers. This can lead to account takeover or a Denial of Service (DoS) condition. The affected component is the Identity Provider service.

Recommendations Update usememos memos to a newer version that addresses this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

LPE

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-65797

GHSA-99M2-QWX6-2W6F

GO-2025-4220

SUSE-SU-2026:0037-1

Affected Products

Usememos/Memos

References · 91

• 🔥 https://herolab.usd.de/security-advisories/usd-2025-0057 · Exploit
• https://github.com/usememos/memos/pull/5217 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2026:0037-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65797 · Security Note
• https://osv.dev/vulnerability/GO-2025-4220 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-65797 · Vendor Advisory
• https://github.com/usememos/memos/commit/769dcd0cf9be83d472829f6e7903b201e42f6b3c · Note
• http://memos.com · Note
• https://suse.com/security/cve/CVE-2025-68941 · Note
• https://suse.com/security/cve/CVE-2025-67508 · Note
• https://suse.com/security/cve/CVE-2025-10543 · Note
• https://suse.com/security/cve/CVE-2025-60633 · Note
• https://suse.com/security/cve/CVE-2025-68939 · Note
• https://suse.com/security/cve/CVE-2025-65637 · Note
• https://suse.com/security/cve/CVE-2025-66508 · Note