PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-113601 usememos CVE debrief

CVE-2026-113601 debrief: Memos before 0.27.0 Missing Authorization via ActivityService ListActivities/GetActivity. The vulnerability allows authenticated users to view all users' activity records due to missing authorization in the ActivityService ListActivities and GetActivity API methods. Low-privileged attackers can enumerate sequential activity IDs to obtain creator IDs, timestamps, and memo-comment references, including activity on other users' private memos. Defenders should assess exposure and potential impacts on user activity records.

Vendor
usememos
Product
memos
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-20
Original CVE updated
2026-10-23
Advisory published
2026-10-20
Advisory updated
2026-10-23

Who should care

Defenders responsible for Memos instances should assess exposure and potential impacts on user activity records. This includes reviewing the current version of Memos, understanding the vulnerability's impact, and taking appropriate actions to protect user activity records. Security teams and vulnerability management teams should also prioritize verifying exposure and assessing potential impacts.

Why it matters

Defenders should prioritize verifying exposure and assessing potential impacts on user activity records due to the missing authorization vulnerability in Memos before 0.27.0.

  • Potential unauthorized access to user activity records
  • Enumeration of sequential activity IDs to obtain creator IDs, timestamps, and memo-comment references

Technical summary

Memos before 0.27.0 contains a missing authorization vulnerability in the ActivityService ListActivities and GetActivity API methods. This allows authenticated users to view all users' activity records. The vulnerability can be exploited by enumerating sequential activity IDs to obtain creator IDs, timestamps, and memo-comment references, including activity on other users' private memos. Defenders should prioritize verifying exposure and assessing potential impacts on user activity records due to this vulnerability.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impacts on user activity records.

Recommended defensive actions

  • Verify Memos version and assess exposure
  • Restrict access to ActivityService ListActivities and GetActivity API methods
  • Monitor user activity records for potential unauthorized access
  • Implement compensating controls for exposed systems
  • Conduct asset inventory of Memos instances
  • Review and adjust rollback/change windows for updates
  • Track exceptions and retest remediated assets

Evidence notes

The CVE record and source item provide details on the missing authorization vulnerability in Memos before 0.27.0. The vulnerability is in the ActivityService ListActivities and GetActivity API methods, allowing authenticated users to view all users' activity records. Evidence is limited to CVE and source-item details. Defenders should verify exposure and assess potential impacts on user activity records.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-113601 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-113601

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-113601 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-113601

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Memos before 0.27.0 Missing Authorization via ActivityService ListActivities/GetActivity

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/113xxx/CVE-2026-113601.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://github.com/usememos/memos/issues/5651

    Supplemental source - issue-tracking

  • Source reference

    Unverified legacy reference

    URL: https://github.com/usememos/memos/commit/04f239a2fc74f7090c779a6a7b8a08238fd31b88

    Supplemental source - patch

  • Source reference

    Unverified legacy reference

    URL: https://github.com/usememos/memos/releases/tag/v0.27.0

    Supplemental source - release-notes

  • Source reference

    Unverified legacy reference

    URL: https://github.com/usememos/memos/blob/v0.26.2/server/router/api/v1/activity_service.go

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/memos-before-0.27.0-missing-authorization-via-activityservice-listactivities-getactivity

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.