---
id: "CVE-2026-113601"
kind: "vulnerability"
aliases: ["CVE-2026-113601"]
title: "Memos: missing authorization lets any user read other users' activity records"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["memos", "package", "self-hosted"]
not_affected_if: ["single-user-instance", "version-0.27.0-or-later"]
published_at: "2026-10-20T16:17:09+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-25T04:24:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113601", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# Memos: missing authorization lets any user read other users' activity records

Memos before 0.27.0 does not check authorization in the ActivityService ListActivities and GetActivity API methods. An authenticated user can read activity records of all users, including references to other users' private memos.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Memos version: `memos --version` or the image tag in your deployment, and see if it is below `0.27.0`.
- unknown

## Fix

- Upgrade Memos to `0.27.0` or later.
- unknown

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113601

## From the sources

Memos before 0.27.0 contains a missing authorization vulnerability in the ActivityService ListActivities and GetActivity API methods that allows authenticated users to view all users' activity records. Low-privileged attackers can enumerate sequential activity IDs to obtain creator IDs, timestamps, and memo-comment references, including activity on other users' private memos.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_