{"id":"CVE-2026-113601","kind":"vulnerability","aliases":["CVE-2026-113601"],"related":[],"title":"Memos: missing authorization lets any user read other users' activity records","description":"Memos before 0.27.0 contains a missing authorization vulnerability in the ActivityService ListActivities and GetActivity API methods that allows authenticated users to view all users' activity records. Low-privileged attackers can enumerate sequential activity IDs to obtain creator IDs, timestamps, and memo-comment references, including activity on other users' private memos.","summary":"Memos before 0.27.0 does not check authorization in the ActivityService ListActivities and GetActivity API methods. An authenticated user can read activity records of all users, including references to other users' private memos.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["memos","package","self-hosted"],"not_affected_if":["single-user-instance","version-0.27.0-or-later"],"how_to_check":"- Check the installed Memos version: `memos --version` or the image tag in your deployment, and see if it is below `0.27.0`.\n- unknown","fix":"- Upgrade Memos to `0.27.0` or later.\n- unknown","status":"open","published_at":"2026-10-20T16:17:09+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T04:24:40+00:00","updated_at":"2026-10-25T04:24:40+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:24:40Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Memos to `0.27.0` or later.\n- unknown","reach":"internet","title":"Memos: missing authorization lets any user read other users' activity records","impact":"medium","summary":"Memos before 0.27.0 does not check authorization in the ActivityService ListActivities and GetActivity API methods. An authenticated user can read activity records of all users, including references to other users' private memos.","category":"package","nicknames":[],"who_cares":["memos","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Authenticated users read other users' activity and private memo references","analyst_note":"Confirm the fixed version and whether the flaw is reachable from the internet by default; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-113601 and the Memos release notes for 0.27.0.","how_to_check":"- Check the installed Memos version: `memos --version` or the image tag in your deployment, and see if it is below `0.27.0`.\n- unknown","needs_analyst":true,"not_affected_if":["single-user-instance","version-0.27.0-or-later"],"who_is_affected":"Teams that self-host Memos below 0.27.0 with more than one user account. Single-user instances have no other users' records to expose. Any account on the instance, including a low-privileged one, can reach the flawed API methods. Sources do not say whether the flaw is reachable without an account.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000599,"input_tokens":3336,"output_tokens":531,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113601':14A,17A '-2026':13A,16A '0.27.0':25B,57C 'activ':10A,43B,79C,88C,101C 'activityservic':32B,65C 'allow':72C 'api':36B,69C 'attack':84C 'authent':39B,73C 'author':3A,29B,61C 'check':28B 'comment':98C 'contain':58C 'creator':92C 'cve':12A,15A 'enumer':86C 'getact':35B,68C 'host':22B 'id':89C,93C 'includ':48B,100C 'let':4A 'listact':33B,66C 'low':82C 'low-privileg':81C 'memo':1A,18B,23B,54B,55C,97C,106C 'memo-com':96C 'method':37B,70C 'miss':2A,60C 'obtain':91C 'packag':19B 'privat':53B,105C 'privileg':83C 'read':7A,42B 'record':11A,44B,80C 'refer':49B,99C 'self':21B 'self-host':20B 'sequenti':87C 'timestamp':94C 'user':6A,9A,40B,47B,52B,74C,78C,104C 'view':76C 'vulner':62C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Memos below 0.27.0 with more than one user account. Single-user instances have no other users' records to expose. Any account on the instance, including a low-privileged one, can reach the flawed API methods. Sources do not say whether the flaw is reachable without an account.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T16:17:09+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113601","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113601","severity":null,"published_at":"2026-10-20T16:17:09+00:00","modified_at":"2026-10-23T02:16:55+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}