memos vulnerability allows the creation of arbitrary accounts

ALTO 7.5CVE-2025-65795 · GHSA-mg56-wc4q-rw4w · GO-2025-4217 · Published 08/12/2025 · updated 15/10/2026

Em resumo

CVE-2025-65795 é uma vulnerabilidade ALTO (CVSS 7.5) que afeta github.com/usememos/memos, memos (usememos).
Chance de exploração nos próximos 30 dias (EPSS): 0.26%, maior que 17.4% das vulnerabilidades.
Correção: atualize para 0.25.3 ou posterior.

Package	Affected versions	Patched versions
github.com/usememos/memos Go	`< 0.25.3`	`0.25.3`
memos usememos	`= 0.25.2`	No fix yet

Description

Incorrect access control in the /api/v1/user endpoint of usememos memos v0.25.2 allows unauthorized attackers to create arbitrary accounts via a crafted request.

NVD description

Incorrect access control in the /api/v1/user endpoint of usememos memos v0.25.2 allows unauthorized attackers to create arbitrary accounts via a crafted request.

References

nvd.nist.gov/vuln/detail/CVE-2025-65795 · ADVISORY
usememos/memos#5217 · WEB
usememos/memos commit 769dcd0 · WEB
GitHub Advisory GHSA-mg56-wc4q-rw4w · ADVISORY
usememos/memos · PACKAGE
herolab.usd.de/usd-2025-0058 · WEB
memos.com · WEB
usememos.com · WEB
herolab.usd.de/usd-2025-0058 · Exploit

Mais vulnerabilidades de github.com/usememos/memos

Ver tudo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/usememos/memos

< 0.25.3

0.25.3

memos

usememos

= 0.25.2

No fix yet

Description

Incorrect access control in the /api/v1/user endpoint of usememos memos v0.25.2 allows unauthorized attackers to create arbitrary accounts via a crafted request.

NVD description

Incorrect access control in the /api/v1/user endpoint of usememos memos v0.25.2 allows unauthorized attackers to create arbitrary accounts via a crafted request.

Mais vulnerabilidades de github.com/usememos/memos

Ver tudo →