CVE-2026-113601 debrief: Memos before 0.27.0 Missing Authorization via ActivityService ListActivities/GetActivity. The vulnerability allows authenticated users to view all users' activity records due to missing authorization in the ActivityService ListActivities and GetActivity API methods. Low-privileged attackers can enumerate sequential activity IDs to obtain creator IDs, timestamps, and memo-comment r [truncated]
The vulnerability, identified as CVE-2026-51584, exists in usememos v0.27.1 and allows a remote attacker to achieve account takeover via the ssoCredentials branch of the SignIn handler in server/router/api/v1/auth_service.go. This issue arises because SSO identity is matched only on an attacker-controllable identifier without binding to the IdP's stable subject claim. The affected product is usememos v0.2 [truncated]
The Memos webhook dispatch function safeDialContext() is vulnerable to a time-of-check/time-of-use DNS-rebinding bypass of the SSRF protection. This occurs because the function resolves the target hostname via net.DefaultResolver.LookupHost() and validates the resulting IPs against reserved ranges, but then dials net.JoinHostPort(host, port) using the original hostname rather than the already-validated IP [truncated]
