Memos EUVD-2026-23838

This vulnerability requires an authenticated user account on the target usememos memos instance (PR:L in CVSS indicates low-privilege authentication required - not administrative or special role). The attacker must have network access to the memos application's HTTP endpoint hosting the UpdateInstanceSetting component (network-based attack, AV:N). No special configuration or non-default setup is required; the vulnerability exists in the standard UpdateInstanceSetting component as shipped in versions up to 0.22.1. The specific condition enabling exploitation is that the additionalStyle and additionalScript parameters are processed by the memos_access_token function without proper authorization checks, meaning any authenticated user can invoke these parameters regardless of their assigned role or capabilities. The attack does not require user interaction (UI:N), administrator privileges, or custom deployment modes. However, exploitation is inherently limited to users who can obtain valid authentication credentials to the memos instance, creating a dependency on either credential compromise (phishing, credential stuffing, previous data breach) or insider threat. Self-hosted memos instances that restrict network access to corporate networks or VPNs further limit exploitation to internal threat actors with network access.

This vulnerability presents moderate real-world risk with several concerning signals. The CVSS v3.1 score of 6.3 (medium severity) with a network attack vector (AV:N) and low attack complexity (AC:L) indicates broad exploitability. However, the presence of login requirement (PR:L - low privilege) significantly reduces the immediate threat surface compared to unauthenticated remote code execution scenarios. The EPSS score input was not provided, limiting probabilistic exploitation assessment; however, the combination of publicly available exploit code and vendor non-responsiveness elevates concern. The exploit proof-of-concept availability is the highest-confidence exploitation signal present. The impact vector (C:L/I:L/A:L) indicates partial confidentiality, integrity, and availability impact - consistent with authorization bypass enabling unauthorized data access or modification, not full system compromise. The E:P (Proof of Concept) and RC:R (Reasonable Confidence) ratings in the CVSS vector reinforce that exploitation is demonstrable and reproducible. Real-world priority depends on organizational user base size and whether memos stores sensitive information; for enterprises using memos for internal knowledge management or note storage, this warrants prompt patching. The authentication requirement means external threat actors cannot exploit this without first obtaining valid user credentials, which may come through separate phishing, credential compromise, or insider threats. Organizations with strong privileged access management and credential hygiene face lower risk than those with weak password policies.

An authenticated user with limited memos account privileges (such as a read-only user or collaborator with restricted permissions) crafts an HTTP request to the UpdateInstanceSetting endpoint, manipulating the additionalStyle or additionalScript parameters to inject unauthorized payload. The memos_access_token function fails to validate whether the authenticated user has permission to modify these settings, allowing the request to succeed. The attacker then gains elevated access to sensitive memos content, modifies memos created by other users, or injects malicious client-side script that executes when other users access the application, enabling session hijacking or further lateral movement within the memos instance. Publicly available exploit code on GitHub demonstrates this attack pattern, making reproducibility straightforward for attackers with valid memos credentials.