Memos EUVD-2026-53356

The attacker must hold a valid, low-privileged Memos account with permission to create or modify webhooks, as reflected by PR:L in the CVSS vector. The Memos server must be running on a Linux host: the 0.0.0.0-to-loopback kernel routing behavior that makes this SSRF reachable is Linux-specific and does not apply to Windows or macOS deployments. No non-default configuration of Memos is required - any standard Linux-hosted instance permitting webhook registration by non-admin users is vulnerable. Exploitation is bounded by the services actually listening on loopback at the time of the request; impact escalates significantly if unauthenticated services such as Redis, Docker API, or a local admin panel are present. The requirement for authenticated access is the primary limiting factor: unauthenticated external actors cannot register webhooks.

The CVSS 8.5 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) accurately represents the real-world risk profile. The Changed Scope and High Confidentiality ratings are the primary risk drivers: SSRF to loopback in containerized or cloud-hosted environments routinely exposes unauthenticated internal APIs, credential stores, or infrastructure metadata, which can escalate to full system compromise. The PR:L requirement is a meaningful constraint - unauthenticated actors cannot register webhooks, so the attack surface is limited to users holding valid Memos accounts. The Linux-specific kernel routing behavior is a genuine scope limiter: Windows and macOS do not route 0.0.0.0 to loopback in the same manner, restricting exploitation to Linux deployments. No EPSS score was provided in the intelligence data, so exploitation probability cannot be quantified numerically; however, SSRF-to-loopback is a well-understood, low-skill technique once account access is obtained. The wildcard CPE (version *) with no confirmed upper boundary means all deployed instances should be treated as vulnerable - no patch version was available at time of analysis, which elevates urgency for organizations without compensating network controls.

An attacker holding a low-privileged Memos account navigates to the webhook configuration interface and registers a URL such as http://0.0.0.0:2375/ or http://0.0.0.0:6379/, targeting Docker daemon or Redis ports commonly bound to loopback on self-hosted deployments. When any memo event triggers the webhook, the Memos server calls isReservedIP(), passes validation because 0.0.0.0 is not in the checked CIDR list, and issues an outbound HTTP GET to its own loopback interface on the specified port - returning any plaintext response body to the attacker as webhook delivery data. No public proof-of-concept code has been identified at time of analysis, but the technique requires only a standard HTTP client and knowledge of common loopback service ports.