Edgeever
Monthly
Holders of scoped EdgeEver API tokens can exceed their granted permissions in versions through 1.108.0, because the Hono-based memo-template routes never call the requireScopes authorization check - allowing a token that explicitly lacks the write:memos scope to create memos via POST /api/v1/templates/:id/use and to list, modify, or delete templates in the token owner's workspace. The flaw is authenticated (CVSS vector PR:L) and limited in blast radius: exploitation is confined to the token owner's own workspace and produces only integrity impact, with no confidentiality disclosure or service-availability loss (assessed CVSS 3.1 base 5.3). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; this is a genuine but moderate-severity authorization bypass rather than an emergency, since an attacker must first be issued a valid workspace-scoped token.
Holders of scoped EdgeEver API tokens can exceed their granted permissions in versions through 1.108.0, because the Hono-based memo-template routes never call the requireScopes authorization check - allowing a token that explicitly lacks the write:memos scope to create memos via POST /api/v1/templates/:id/use and to list, modify, or delete templates in the token owner's workspace. The flaw is authenticated (CVSS vector PR:L) and limited in blast radius: exploitation is confined to the token owner's own workspace and produces only integrity impact, with no confidentiality disclosure or service-availability loss (assessed CVSS 3.1 base 5.3). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; this is a genuine but moderate-severity authorization bypass rather than an emergency, since an attacker must first be issued a valid workspace-scoped token.