Live › vulnerability › CVE-2026-113601
Go to dashboardMemos before 0.27.0 does not check authorization in the ActivityService ListActivities and GetActivity API methods. An authenticated user can read activity records of all users, including references to other users' private memos.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that self-host Memos below 0.27.0 with more than one user account. Single-user instances have no other users' records to expose. Any account on the instance, including a low-privileged one, can reach the flawed API methods. Sources do not say whether the flaw is reachable without an account.
No product ranges from the sources yet.
memos --version or the image tag in your deployment, and see if it is below 0.27.0.0.27.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Memos before 0.27.0 contains a missing authorization vulnerability in the ActivityService ListActivities and GetActivity API methods that allows authenticated users to view all users' activity records. Low-privileged attackers can enumerate sequential activity IDs to obtain creator IDs, timestamps, and memo-comment references, including activity on other users' private memos.
This page as .md · .json · in your agent: get_signal("CVE-2026-113601")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.