Authorization Vulnerability in Memos Affecting ActivityService API Methods
CVE-2026-113601

5.3MEDIUM

Key Information:

Vendor

Usememos

Status
Memos
Vendor
CVE Published:
20 October 2026

What is CVE-2026-113601?

An authorization vulnerability exists in Memos before version 0.27.0, specifically within the ActivityService ListActivities and GetActivity API methods. This flaw permits authenticated users to access and view the activity records of all users. Low-privileged attackers can exploit this vulnerability by enumerating sequential activity IDs, allowing them to retrieve sensitive data such as creator IDs, timestamps, and references to memo comments, including private activities associated with other users. It is essential for users of Memos to upgrade to version 0.27.0 or later to mitigate this security risk.

Affected Version(s)

memos 0 < 0.27.0

References

https://github.com/usememos/memos/issues/5651
issue-tracking
https://github.com/usememos/memos/commit/04f239a2fc74f709...
patch
https://github.com/usememos/memos/releases/tag/v0.27.0
release-notes

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

lighthousekeeper1212
leediay153 from Viettel Post
.