memos vulnerability allows the creation of arbitrary accounts

ÉLEVÉE 7.5CVE-2025-65795 · GHSA-mg56-wc4q-rw4w · GO-2025-4217 · Published 08/12/2025 · updated 15/10/2026

En bref

CVE-2025-65795 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant github.com/usememos/memos, memos (usememos).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.26%, plus élevée que 17.4% des vulnérabilités.
Correctif : mettre à jour vers 0.25.3 ou plus récent.

Package	Affected versions	Patched versions
github.com/usememos/memos Go	`< 0.25.3`	`0.25.3`
memos usememos	`= 0.25.2`	No fix yet

Description

Incorrect access control in the /api/v1/user endpoint of usememos memos v0.25.2 allows unauthorized attackers to create arbitrary accounts via a crafted request.

NVD description

Incorrect access control in the /api/v1/user endpoint of usememos memos v0.25.2 allows unauthorized attackers to create arbitrary accounts via a crafted request.

References

nvd.nist.gov/vuln/detail/CVE-2025-65795 · ADVISORY
usememos/memos#5217 · WEB
usememos/memos commit 769dcd0 · WEB
GitHub Advisory GHSA-mg56-wc4q-rw4w · ADVISORY
usememos/memos · PACKAGE
herolab.usd.de/usd-2025-0058 · WEB
memos.com · WEB
usememos.com · WEB
herolab.usd.de/usd-2025-0058 · Exploit

Autres vulnérabilités de github.com/usememos/memos

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/usememos/memos

< 0.25.3

0.25.3

memos

usememos

= 0.25.2

No fix yet

Description

Incorrect access control in the /api/v1/user endpoint of usememos memos v0.25.2 allows unauthorized attackers to create arbitrary accounts via a crafted request.

NVD description

Incorrect access control in the /api/v1/user endpoint of usememos memos v0.25.2 allows unauthorized attackers to create arbitrary accounts via a crafted request.

Autres vulnérabilités de github.com/usememos/memos

Tout voir →