CVE-2026-113601— Memos before 0.27.0 Missing Authorization via ActivityService ListActivities/GetActivity
Quick assessment
Affected
usememos memos
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Memos 在 0.27.0 之前的版本中，其 的 和 API 方法存在授权缺失漏洞，导致已认证用户可以查看所有用户的活动记录。低权限攻击者可通过枚举连续的活动 ID，获取创建者 ID、时间戳以及备忘录评论的引用信息，其中包括其他用户私有备忘录的活动记录。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-113601
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Memos before 0.27.0 Missing Authorization via ActivityService ListActivities/GetActivity
Source: CVE Program / CVE List V5
Vulnerability Description
Memos before 0.27.0 contains a missing authorization vulnerability in the ActivityService ListActivities and GetActivity API methods that allows authenticated users to view all users' activity records. Low-privileged attackers can enumerate sequential activity IDs to obtain creator IDs, timestamps, and memo-comment references, including activity on other users' private memos.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-113601
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-113601
请登录查看更多情报信息。
Other References for CVE-2026-113601 (5)
-
https://github.com/usememos/memos/blob/v0.26.2/server/router/api/v1/activity_service.go technical-description
-
https://github.com/usememos/memos/issues/5651 issue-tracking
-
https://github.com/usememos/memos/releases/tag/v0.27.0 release-notes
IV. Related Vulnerabilities
Same product: memos
-
CVE-2026-84203
Memos 0.26.0 through 0.30.0 Insufficient Session Expiration -
CVE-2026-82476
Memos through 0.30.0 SSRF via Omitted CGNAT Address Range -
CVE-2026-75110
MemOS Authentication Bypass via Unset INTERNAL_SERVICE_SECRE -
CVE-2026-71271
Memos Webhook SSRF via 0.0.0.0 Reserved-IP Bypass -
CVE-2026-71272
Memos Webhook DNS Rebinding TOCTOU SSRF in safeDialContext()
Same vendor: usememos
-
CVE-2026-84203
Memos 0.26.0 through 0.30.0 Insufficient Session Expiration -
CVE-2026-82476
Memos through 0.30.0 SSRF via Omitted CGNAT Address Range -
CVE-2026-71271
Memos Webhook SSRF via 0.0.0.0 Reserved-IP Bypass -
CVE-2026-71272
Memos Webhook DNS Rebinding TOCTOU SSRF in safeDialContext() -
CVE-2026-6634
usememos UpdateInstanceSetting App.tsx memos_access_token im
Same weakness: CWE-862
-
CVE-2026-113660
ApostropheCMS: Authenticated Object-Level Authorization Bypa -
CVE-2026-113649
ApostropheCMS: Import API bypasses publication roles for pro -
CVE-2026-112957
ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses -
CVE-2026-113677
Froxlor 0.10.0 before 2.3.15 Missing Authorization via SubDo -
CVE-2026-113612
SparkyFitness before 0.17.0 Missing Authorization via food-v
V. Comments for CVE-2026-113601
No comments yet