CVE-2022-4687: usememos memos Incorrect Use of Privileged APIs
CVSS: 8.1v3.0HighModified
AliasesGHSA-fv6c-rfg3-gvjwGO-2022-1217
Published 23-12-2022Last modified 09-04-2025
Vulnerability summary
CVE-2022-4687 is a high (CVSS 8.1) Incorrect Use of Privileged APIs vulnerability in usememos memos. EPSS estimates a 0.65% chance of exploitation in the next 30 days, higher than 50.3% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
8.1/10
010
High · v3.0 (CVE.org)EPSS score
0.65%
0%100%
Low · +0.02 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Timeline
- 23-12-2022PublishedVulnerability first disclosed.
- 09-04-2025Last modifiedVulnerability information updated.
Description
Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.0.
CVSS metrics
4 scores · 3 sources · 2 versionsHigh 8.1Preferred score · OSV · Go (Ecosystem advisory) · calculated from vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NSourcesAll 2 agree
- NVDNIST8.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
High 8.1Preferred score · CVE.org (CNA)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NSourcesAll 2 agree
- NVDNIST8.1HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS trend
Probability
0.65%
Chance of exploitation in the next 30 days
Percentile
50%
Versus all other CVEs
30-day change
+0.02 pp
From 0.63% on 20-09-2026
20-09-202620-10-2026
EPSS score0.65%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (huntr.dev)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-648Incorrect Use of Privileged APIsThe product does not conform to the API requirements for a function call that requires extra privileges. This could allow attackers to gain privileges by causing the function to be called incorrectly.
- CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Affected systems
Usememos2 products
- memos< 0.9.0
- usememos/memos≥ unspecified, < 0.9.0
Github.com/usememos1 product
- memos< 0.9.0
2 vendors · 3 products
References
5 links- github.com/usememos/memos/commit/dca35bde877aab6e64ef51b52e590b5d48f692f9WEBFIXPatchThird Party Advisory
- huntr.dev/bounties/b908377f-a61b-432c-8e6a-c7498da69788WEBExploitIssue TrackingPatchThird Party Advisory
- github.com/usememos/memosPACKAGE