CVE-2026-6634: usememos memos Incorrect Privilege Assignment
Vulnerability summary
CVE-2026-6634 is a medium (CVSS 6.5) Incorrect Privilege Assignment vulnerability in usememos memos. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 26.8% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 20-04-2026PublishedVulnerability first disclosed.
- 20-04-2026Last modifiedVulnerability information updated.
Description
A weakness has been identified in usememos memos up to 0.22.1. This affects the function memos_access_token of the file src/App.tsx of the component UpdateInstanceSetting. This manipulation of the argument additionalStyle/additionalScript causes improper authorization. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS metrics
9 scores · 3 sources · 4 versions- OSV · GoEcosystem advisory · calculated5.3MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
- NVDNIST2.1LowCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XDiffers
- OSV · GoEcosystem advisory · calculated6.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- NVDNIST6.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- NVDNIST6.5MediumAV:N/AC:L/Au:S/C:P/I:P/A:P
EPSS trend
Probability
0.35%
Chance of exploitation in the next 30 days
Percentile
27%
Versus all other CVEs
30-day change
+0.09 pp
From 0.25% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundSecurity Advisories
Maturity: poc
Weaknesses
CWE · root cause- CWE-266Incorrect Privilege AssignmentA product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
- CWE-285Improper AuthorizationThe product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Affected systems
Github.com/usememos1 product
- memos≤ 0.22.1 | All versions (No fix recorded)
Usememos1 product
- memos0.22.0 | 0.22.1
2 vendors · 2 products
References
7 links
- github.com/usememos/memosPACKAGE