EUVD-2026-96893
GHSA-v569-q6j4-2968
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain scoped API token lacking write:memos
-
ExploitSave crafted memo template via template route
-
ExecutionCall POST /api/v1/templates/:id/use (no requireScopes check)
-
ImpactCreate, modify, or delete memos and templates in workspace
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must already possess a valid, workspace-scoped EdgeEver API token - even one explicitly lacking the write:memos scope (PR:L). No user interaction or additional configuration is required; the memo-template routes (template-routes.ts) simply omit the requireScopes authorization call, so any token holder can reach POST /api/v1/templates/:id/use and the template list/modify/delete endpoints. Limiting factors: exploitation is confined to the token owner's own workspace, requires prior token issuance (authenticated), and yields only integrity impact (creating/altering/deleting memos and templates) - there is no confidentiality disclosure or service-availability loss. Affects EdgeEver versions through 1.108.0. |
| Impact | This is a genuine but moderate-severity authorization flaw, not a drop-everything emergency. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N, score 5.3) is internally consistent with the description: exploitation is network-reachable and low-complexity but requires an already-issued scoped API token (PR:L), and impact is limited to integrity (VI:L) with no confidentiality or availability loss. No EPSS score was provided and the CVE is NOT on the CISA KEV list, so there is no evidence of active exploitation. A detailed public technical writeup (hackmd) plus direct source-code line references documenting the missing requireScopes call effectively constitute public exploit knowledge, which raises practical exploitability for anyone who already holds a token. The real-world risk is bounded by the PR:L prerequisite - an attacker must first obtain a valid (even under-scoped) API token for the target workspace - and by the fact that impact stays within that token owner's own workspace. Net: a legitimate scope-escalation bug worth patching, but the limited blast radius, authenticated precondition, and absence of KEV/EPSS signals place it well below critical priority. |
| Exploit ScenarioDerived | An attacker or malicious integration holding a scoped EdgeEver API token that was deliberately restricted (e.g. read-only, lacking write:memos) saves a memo template, then calls POST /api/v1/templates/:id/use to materialize that template into a new memo - writing data the token was never authorized to write. The same unchecked routes also let the token holder list, modify, and delete templates across the workspace. A public technical writeup detailing the exact bypass exists, lowering the skill barrier to reproduce it. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
Holders of scoped EdgeEver API tokens can exceed their granted permissions in versions through 1.108.0, because the Hono-based memo-template routes never call the requireScopes authorization check - allowing a token that explicitly lacks the write:memos scope to create memos via POST /api/v1/templates/:id/use and to list, modify, or delete templates in the token owner's workspace. The flaw is authenticated (CVSS vector PR:L) and limited in blast radius: exploitation is confined to the token owner's own workspace and produces only integrity impact, with no confidentiality disclosure or service-availability loss (assessed CVSS 3.1 base 5.3). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; this is a genuine but moderate-severity authorization bypass rather than an emergency, since an attacker must first be issued a valid workspace-scoped token.
RemediationAI
No vendor-released patch identified at time of analysis - the input contains no fixed version, and the GitHub references cited (template-routes.ts and memo-routes.ts at commit 0ef9a1df9c849a64047aba64c70331c2badf8b39) point to the vulnerable code rather than a fix, so confirm patched status against the upstream repository (https://github.com/tianma-if/edgeever) and the VulnCheck advisory before assuming a release resolves the issue. Until a fix is confirmed, apply the following compensating controls, accepting their trade-offs: first, block the template API at the edge or reverse proxy with a rule rejecting /api/v1/templates/* (including POST /api/v1/templates/:id/use), which fully closes this vector but disables legitimate template management for all users; second, audit and revoke every stored API token that carries limited scopes and reissue tokens only to trusted integrations, since the bypass is worthless without a valid token - the trade-off is disruption to any automation relying on those tokens, and it does not protect against a token holder who is themselves malicious; third, where EdgeEver supports it, disable multi-token or third-party token issuance entirely so only the workspace owner can act, which is restrictive but removes the practical attack surface for single-tenant deployments; fourth, enable request logging on the template endpoints and alert on calls to /api/v1/templates/:id/use from tokens or clients that were not explicitly granted write:memos, as detection does not prevent the integrity writes but will surface misuse. Because the upstream cause is a single omitted requireScopes call, self-patching by adding the scope check to template-routes.ts in line with the memo-route pattern is a low-risk temporary fix for teams that build from source.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
EdgeEver (GitHub project tianma-if/edgeever) is an edge-deployed note/memo application whose API is built on the Hono web framework and TypeScript. Authorization is enforced through a scope-checking middleware invoked as requireScopes inside individual route handlers: the memo routes (apps/api/src/memo-routes.ts, lines 148-150) demonstrate the intended pattern of gating write operations on a scope such as write:memos, but the template routes (apps/api/src/template-routes.ts, lines 116-230) were implemented without that call. The root cause is therefore CWE-862 (Missing Authorization): the endpoint is reachable and functional for any caller passing the API-token authentication layer, regardless of the scopes encoded in that token. The concrete consequence is that a token deliberately minted without write:memos still satisfies authentication but not the (absent) scope gate, so its holder can invoke POST /api/v1/templates/:id/use to materialize new memos and can also enumerate, edit, and delete templates belonging to the token's workspace. Per the provided CPE (cpe:2.3:a:tianma-if:edgeever:*:*:*:*:*:*:*:*) all released versions through 1.108.0 are in scope. Unlike a memory-safety or injection bug, there is no data-flow taint element here - the single defect is the omission of one authorization call, which makes the affected endpoints consistent with the memo endpoints' scope enforcement the complete fix.
Know when Edgeever gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Requires a valid but under-scoped API token (PR:L) over the network with low complexity; impact is integrity-only (create/modify/delete memos and templates) within the same workspace, so C:N/A:N and scope unchanged.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
EdgeEver through 1.108.0 contains a missing authorization vulnerability in the Hono API memo-template routes that allows holders of scoped API tokens to bypass token scope restrictions because template handlers never call requireScopes. Attackers with a token lacking write:memos can save a template and invoke POST /api/v1/templates/:id/use to create memos, and list, modify, or delete templates in the token owner's workspace.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB