Memos CVE-2026-113601

Requires an authenticated account on the Memos instance at any privilege level (PR:L) - the attacker needs valid credentials but no administrative or creator rights over the targeted records. Affected deployments are Memos versions before 0.27.0 exposing the ActivityService ListActivities and GetActivity endpoints (default configuration; no special feature toggle is needed). Exploitation is enabled by activity records using a system-generated auto-incremented integer ID, making IDs trivially guessable via sequential enumeration. Limiting factors: exploitation is impossible for fully unauthenticated outsiders, and practical blast radius is far larger on instances that allow open/self-service user registration or host many tenants than on single-user or trusted-team instances. Disclosure is limited to activity metadata (creator IDs, timestamps, memo and related-memo comment references), not guaranteed full private memo content.

This is a genuine but modest-severity information-disclosure issue, not a top-tier emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the 5.3 Medium score are internally consistent with the description: network-reachable, low-complexity, but requiring an authenticated low-privileged account (PR:L) and yielding only confidentiality impact (VC:L, with VI/VA:N). The signals do not conflict - attack vector, privilege requirement, and impact all align with a horizontal authorization bypass that leaks activity metadata rather than full content. No EPSS score, SSVC decision, or KEV entry was provided in the input, and no public exploit is referenced, so exploitation-probability data is MISSING and cannot be asserted. Exploitation is conceptually trivial (sequential integer ID enumeration against the GetActivity endpoint), which raises practical likelihood for any instance that permits untrusted user registration, but the requirement for a valid account and the limited, metadata-only disclosure (creator IDs, timestamps, memo-comment references - not necessarily full private memo bodies) keep real-world risk in the moderate range. Prioritize patching on multi-tenant or public-signup Memos instances; treat single-user or trusted-group deployments as low urgency.

An attacker registers or already holds a low-privileged account on a shared Memos instance, then repeatedly calls the GetActivity API (GET /api/v1/activities/{id}) incrementing the sequential, auto-incremented activity ID. Because the ActivityService performs no per-record authorization check, each response leaks another user's creator ID, activity timestamp, and the memo/related-memo references of comment activity - including activity tied to other users' private memos. No public exploit code is identified at time of analysis, but the attack requires only trivial ID iteration.