Account Takeover via SSO Misconfiguration in usememos

Executive Summary

CVE-2026-51584 is a vulnerability in Memos v0.27.1 where a remote attacker can take over any account, including admin accounts, by exploiting SSO sign-in. The issue occurs because Memos matches SSO identities only using an attacker-controlled identifier from the Identity Provider (IdP) without linking it to the IdP's stable subject claim. This allows an attacker to set their IdP identifier to match a victim's Memos username and gain unauthorized access.

Useful 0 Not Useful 0

Detection Guidance

Check Memos version with: docker inspect <container_name> | grep MEMOS_VERSION. If version is <=0.27.1, the system is vulnerable. Review auth_service.go for SSO identifier handling in server/router/api/v1/auth_service.go.

Useful 0 Not Useful 0

Impact Analysis

If you use Memos with SSO enabled, an attacker could take over your account, including admin accounts, by manipulating their IdP identifier. This could lead to unauthorized access to your notes, data theft, or further compromise of your Memos instance. The impact is severe as it affects all accounts, including those with administrative privileges.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. If an attacker gains access to personal or health-related notes, it could result in non-compliance with data protection regulations, potential legal penalties, and reputational damage for organizations handling regulated data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Memos to v0.28.0 or later. If using SSO, verify user_identity table exists in the database schema. Revoke sessions for accounts potentially compromised via SSO takeover.

Useful 0 Not Useful 0