Memos CVE-2026-82476

Exploitation requires that the Memos instance's link-metadata fetcher is accessible to the attacker - either because the Memos deployment is internet-facing or because the attacker has network access to it. No authentication is required; the CVSS vector PR:N confirms unauthenticated access is sufficient. The critical environmental prerequisite is that internal hosts or services of interest must reside within the 100.64.0.0/10 CGNAT address range and be reachable from the Memos server's network interface. The impact is limited to reading HTML page titles and meta descriptions - not full response bodies, credentials, or file contents. Exploitation is not possible if the Memos server cannot reach any hosts in 100.64.0.0/10, or if egress filtering already blocks that range at the network layer.

The CVSS 4.0 score of 6.9 reflects a moderate, narrowly scoped confidentiality impact: the attacker receives page titles and HTML meta descriptions from CGNAT-addressed hosts, not full HTTP response bodies, limiting intelligence value. The attack surface is fully remote and unauthenticated (AV:N/AC:L/AT:N/PR:N/UI:N), making mass scanning of exposed Memos instances trivially automatable. Practical exploitability is highly environment-dependent: the 100.64.0.0/10 range is actionable only where internal services or sensitive infrastructure reside in that space. Importantly, the primary cloud hyperscalers (AWS, GCP, Azure) expose instance metadata at 169.254.169.254 (link-local), not in the CGNAT range, so standard cloud VM deployments may not expose metadata credentials through this specific vector - this is a meaningful limiting factor that the CVSS score does not capture. EPSS data was not provided in the available intelligence, and the absence of a KEV listing combined with no confirmed public exploit code suggests opportunistic exploitation is not yet observed. The VulnCheck advisory is the sole upstream source; no independent vendor patch confirmation is available, which introduces uncertainty about fix status.

An unauthenticated attacker discovers a publicly accessible Memos instance and submits a crafted URL pointing to a host in the 100.64.0.0/10 range - for example, an internal API gateway or management interface reachable from the Memos server - to the link-preview or bookmark-creation feature. The Memos server fetches the URL, extracts the page title and meta description, and returns them to the attacker, revealing the name and partial content of internal services. No public proof-of-concept code has been identified, though the straightforward nature of the bypass (simply targeting the overlooked CGNAT range) means exploitation requires no specialized tooling.