PT-2026-33756 · Usememos · Usememos

Davidgilmore · Published 2026-04-20 · Updated 2026-04-20 · CVE-2026-6634

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions usememos memos versions prior to 0.22.2

Description Improper authorization occurs in the UpdateInstanceSetting component within the file src/App.tsx. Specifically, manipulating the additionalStyle or additionalScript arguments in the memos access token() function allows for remote attacks.

Recommendations Update to a version newer than 0.22.1. As a temporary workaround, restrict access to the memos access token() function or avoid using the additionalStyle and additionalScript arguments until a patch is applied.

Exploit

Fix

Improper Authorization

Incorrect Privilege Assignment

Weakness Enumeration

CWE-285

CWE-266

Related Identifiers

CVE-2026-6634

GHSA-GQP3-HFC3-8Q54

Affected Products

Usememos

References · 8

• 🔥 https://github.com/Dave-gilmore-aus/security-advisories/blob/main/usememos-security-advisory · Exploit
• https://osv.dev/vulnerability/GHSA-gqp3-hfc3-8q54 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-6634 · Security Note
• https://github.com/usememos/memos · Note
• https://vuldb.com/vuln/358268 · Note
• https://vuldb.com/submit/793432 · Note
• https://vuldb.com/vuln/358268/cti · Note
• https://twitter.com/VulmonFeeds/status/2046256921355673798 · Twitter Post