CVE-2026-113601
Deferred Deferred - Pending Action

Memos Activity API Missing Authorization Vulnerability

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: VulnCheck

Description
Memos before 0.27.0 contains a missing authorization vulnerability in the ActivityService ListActivities and GetActivity API methods that allows authenticated users to view all users' activity records. Low-privileged attackers can enumerate sequential activity IDs to obtain creator IDs, timestamps, and memo-comment references, including activity on other users' private memos.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-113601
EUVD
EUVD-2026-105167

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
usememos memos 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a missing authorization flaw in Memos versions before 0.27.0. It affects the ActivityService's ListActivities and GetActivity API methods, allowing authenticated users to view all users' activity records without proper access controls. Attackers can exploit this by enumerating sequential activity IDs to gather sensitive data like creator IDs, timestamps, and memo references, including activities on other users' private memos.

Detection Guidance

Check if your Memos instance is running version 0.26.2 or earlier. Inspect API responses from /api/v1/activity/list and /api/v1/activity/{id} for unfiltered activity data across users. Monitor for unauthorized access patterns or unusual activity ID enumeration attempts.

Impact Analysis

If you use Memos before version 0.27.0, an attacker with low privileges could access your activity history, private memos, and interactions with other users. This includes viewing timestamps, creator details, and memo comments, potentially exposing sensitive information or private content.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by exposing private user data without authorization. GDPR requires strict data access controls, while HIPAA mandates protection of health-related information. Unauthorized access to activity records may violate these regulations.

Mitigation Strategies

Upgrade Memos to version 0.27.0 or later immediately. Ensure the ActivityService API endpoints are restricted to authenticated users only. Review logs for suspicious activity ID enumeration attempts and revoke any unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113601. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart