usememos/memos missing Secure cookie attribute

MEDIUM 6.5CVE-2022-4683 · GHSA-qcw2-492v-57xj · GO-2022-1192 · Published 23/12/2022 · updated 17/06/2026

In short

CVE-2022-4683 is a MEDIUM (CVSS 6.5) vulnerability affecting github.com/usememos/memos, memos (usememos).
Chance of exploitation in the next 30 days (EPSS): 0.40%, higher than 34.4% of all vulnerabilities.
Fix: update to 0.9.0 or later.

Package	Affected versions	Patched versions
github.com/usememos/memos Go	`< 0.9.0`	`0.9.0`
memos usememos	`< 0.9.0`	`0.9.0`

Description

usememos/memos is an open-source, self-hosted memo hub with knowledge management and socialization. Memos prior to 0.9.0 is missing the Secure cookie attribute, making it vulnerable to session hijacking.

NVD description

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository usememos/memos prior to 0.9.0.

References

nvd.nist.gov/vuln/detail/CVE-2022-4683 · ADVISORY
usememos/memos commit 7efa749 · WEB
usememos/memos · PACKAGE
huntr.dev/bounties/84973f6b-739a-4d7e-8757-fc58cbbaf6ef · WEB
GitHub Advisory GHSA-qcw2-492v-57xj · ADVISORY

More vulnerabilities in github.com/usememos/memos

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/usememos/memos

< 0.9.0

0.9.0

memos

usememos

< 0.9.0

0.9.0

Description

NVD description

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository usememos/memos prior to 0.9.0.

More vulnerabilities in github.com/usememos/memos

See all →