CVE-2025-65797
Incorrect access control in the Identity Provider service of usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify or delete registered identity providers, leading to an account takeover or Denial of Service (DoS).
- CVSS 3.1
- 6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 20% of CVEs (scores of 2026-10-25)
- CWE
- CWE-284
- Published
- Modified
- Record from
- the NVD, synced
Affected
- usememos:memos
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-99m2-qwx6-2w6f | Go | github.com/usememos/memos | <0.25.3 | 0.25.3 |
| GO-2025-4220 | Go | github.com/usememos/memos | <0.25.3 | 0.25.3 |