# github.com/usememos/memos (Go) vulnerabilities

74 known vulnerabilities (9 critical, 44 high, 21 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: v0.31.0 (Sep 19, 2026): affected by 6 advisories
- Newest unaffected release: Every release is affected by at least one advisory
- Releases: 96 since v0.1.3 (Jul 1, 2022)
- Registry: https://pkg.go.dev/github.com/usememos/memos
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-6634: v0.1.3 to v0.31.0 (through the newest release)
- CVE-2025-65799: v0.1.3 to v0.25.2 (v0.25.3 is outside it)
- CVE-2025-65798: v0.1.3 to v0.25.2 (v0.25.3 is outside it)
- CVE-2025-65797: v0.1.3 to v0.25.2 (v0.25.3 is outside it)
- CVE-2025-65796: v0.1.3 to v0.25.2 (v0.25.3 is outside it)
- CVE-2025-65795: v0.1.3 to v0.25.2 (v0.25.3 is outside it)
- CVE-2024-21635: v0.1.3 to v0.31.0 (through the newest release)
- CVE-2025-56761: v0.1.3 to v0.31.0 (through the newest release)
- CVE-2025-56760: v0.1.3 to v0.31.0 (through the newest release)
- CVE-2025-50738: v0.1.3 to v0.24.3 (v0.24.4 is outside it)
- CVE-2025-22952: v0.1.3 to v0.31.0 (through the newest release)
- CVE-2023-0109: v0.1.3 to v0.9.1 (v0.10.0 is outside it)
- CVE-2024-41659: v0.1.3 to v0.20.1 (v0.21.0 is outside it)
- CVE-2024-29029: v0.1.3 to v0.21.1 (v0.22.0 is outside it)
- CVE-2024-29028: v0.1.3 to v0.16.0 (v0.16.1 is outside it)
- CVE-2024-29030: v0.1.3 to v0.21.1 (v0.22.0 is outside it)
- CVE-2023-5036: v0.1.3 to v0.15.0 (v0.15.1 is outside it)
- CVE-2023-4697: v0.1.3 to v0.13.1 (v0.13.2 is outside it)
- CVE-2023-4698: v0.1.3 to v0.31.0 (through the newest release)
- CVE-2023-4696: v0.1.3 to v0.13.1 (v0.13.2 is outside it)
- CVE-2022-25978: v0.1.3 to v0.10.3 (v0.11.0 is outside it)
- CVE-2023-0112: v0.1.3 to v0.9.1 (v0.10.0 is outside it)
- CVE-2023-0111: v0.1.3 to v0.9.1 (v0.10.0 is outside it)
- CVE-2023-0110: v0.1.3 to v0.9.1 (v0.10.0 is outside it)
- CVE-2023-0108: v0.1.3 to v0.9.1 (v0.10.0 is outside it)
- CVE-2023-0107: v0.1.3 to v0.9.1 (v0.10.0 is outside it)
- CVE-2023-0106: v0.1.3 to v0.9.1 (v0.10.0 is outside it)
- CVE-2022-4866: v0.1.3 to v0.9.0 (v0.9.1 is outside it)
- CVE-2022-4865: v0.1.3 to v0.9.0 (v0.9.1 is outside it)
- CVE-2022-4863: v0.1.3 to v0.9.0 (v0.9.1 is outside it)
- CVE-2022-4851: v0.1.3 to v0.9.0 (v0.9.1 is outside it)
- CVE-2022-4850: v0.1.3 to v0.9.0 (v0.9.1 is outside it)
- CVE-2022-4849: v0.1.3 to v0.9.0 (v0.9.1 is outside it)
- CVE-2022-4848: v0.1.3 to v0.9.0 (v0.9.1 is outside it)
- CVE-2022-4847: v0.1.3 to v0.9.0 (v0.9.1 is outside it)
- CVE-2022-4846: v0.1.3 to v0.9.0 (v0.9.1 is outside it)
- CVE-2022-4845: v0.1.3 to v0.9.0 (v0.9.1 is outside it)
- CVE-2022-4844: v0.1.3 to v0.9.0 (v0.9.1 is outside it)
- CVE-2022-4841: v0.1.3 to v0.9.0 (v0.9.1 is outside it)
- CVE-2022-4840: v0.1.3 to v0.9.0 (v0.9.1 is outside it)
- CVE-2022-4839: v0.1.3 to v0.9.0 (v0.9.1 is outside it)
- CVE-2022-4814: v0.1.3 to v0.9.0 (v0.9.1 is outside it)
- CVE-2022-4813: v0.1.3 to v0.9.0 (v0.9.1 is outside it)
- CVE-2022-4812: v0.1.3 to v0.9.0 (v0.9.1 is outside it)
- CVE-2022-4811: v0.1.3 to v0.9.0 (v0.9.1 is outside it)
- CVE-2022-4810: v0.1.3 to v0.9.0 (v0.9.1 is outside it)
- CVE-2022-4809: v0.1.3 to v0.9.0 (v0.9.1 is outside it)
- CVE-2022-4808: v0.1.3 to v0.9.0 (v0.9.1 is outside it)
- CVE-2022-4807: v0.1.3 to v0.9.0 (v0.9.1 is outside it)
- CVE-2022-4806: v0.1.3 to v0.9.0 (v0.9.1 is outside it)
- CVE-2022-4805: v0.1.3 to v0.9.0 (v0.9.1 is outside it)
- CVE-2022-4804: v0.1.3 to v0.9.0 (v0.9.1 is outside it)
- CVE-2022-4803: v0.1.3 to v0.9.0 (v0.9.1 is outside it)
- CVE-2022-4802: v0.1.3 to v0.9.0 (v0.9.1 is outside it)
- CVE-2022-4801: v0.1.3 to v0.9.0 (v0.9.1 is outside it)
- CVE-2022-4800: v0.1.3 to v0.9.0 (v0.9.1 is outside it)
- CVE-2022-4799: v0.1.3 to v0.9.0 (v0.9.1 is outside it)
- CVE-2022-4798: v0.1.3 to v0.9.0 (v0.9.1 is outside it)
- CVE-2022-4797: v0.1.3 to v0.9.0 (v0.9.1 is outside it)
- CVE-2022-4796: v0.1.3 to v0.9.0 (v0.9.1 is outside it)
- CVE-2022-4767: v0.1.3 to v0.9.0 (v0.9.1 is outside it)
- CVE-2022-4734: v0.1.3 to v0.9.0 (v0.9.1 is outside it)
- CVE-2022-4695: v0.1.3 to v0.8.3 (v0.9.0 is outside it)
- CVE-2022-4694: v0.1.3 to v0.8.3 (v0.9.0 is outside it)
- CVE-2022-4692: v0.1.3 to v0.8.3 (v0.9.0 is outside it)
- CVE-2022-4691: v0.1.3 to v0.8.3 (v0.9.0 is outside it)
- CVE-2022-4690: v0.1.3 to v0.8.3 (v0.9.0 is outside it)
- CVE-2022-4689: v0.1.3 to v0.8.3 (v0.9.0 is outside it)
- CVE-2022-4688: v0.1.3 to v0.8.3 (v0.9.0 is outside it)
- CVE-2022-4687: v0.1.3 to v0.8.3 (v0.9.0 is outside it)
- CVE-2022-4686: v0.1.3 to v0.8.3 (v0.9.0 is outside it)
- CVE-2022-4684: v0.1.3 to v0.8.3 (v0.9.0 is outside it)
- CVE-2022-4683: v0.1.3 to v0.8.3 (v0.9.0 is outside it)
- CVE-2022-4609: v0.1.3 to v0.8.3 (v0.9.0 is outside it)

## Advisories (74)

### [CVE-2026-6634](https://cve.now/CVE-2026-6634): usememos UpdateInstanceSetting App.tsx memos\_access\_token improper authorization

- Severity: Medium 5.3
- Published: Apr 20, 2026
- Affected: through 0.22.1; all versions.
- No fix released. The latest release, v0.31.0, is still affected.

### [CVE-2025-65799](https://cve.now/CVE-2025-65799): A lack of file name validation or verification in the Attachment service of usememos memos v0.25.2 allows attackers to execute a path…

- Severity: Medium 4.3
- Published: Dec 8, 2025
- Affected: fixed in 0.25.3.
- Fixed in v0.25.3 (released Nov 25, 2025, 13 days before disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2025-65798](https://cve.now/CVE-2025-65798): Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify or delete attachments…

- Severity: Medium 5.4
- Published: Dec 8, 2025
- Affected: fixed in 0.25.3.
- Fixed in v0.25.3 (released Nov 25, 2025, 13 days before disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2025-65797](https://cve.now/CVE-2025-65797): Incorrect access control in the Identity Provider service of usememos memos v0.25.2 allows attackers with low-level privileges to…

- Severity: Medium 6.5
- Published: Dec 8, 2025
- Affected: fixed in 0.25.3.
- Fixed in v0.25.3 (released Nov 25, 2025, 13 days before disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2025-65796](https://cve.now/CVE-2025-65796): Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily delete reactions made to…

- Severity: Medium 4.3
- Published: Dec 8, 2025
- Affected: fixed in 0.25.3.
- Fixed in v0.25.3 (released Nov 25, 2025, 13 days before disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2025-65795](https://cve.now/CVE-2025-65795): Incorrect access control in the /api/v1/user endpoint of usememos memos v0.25.2 allows unauthorized attackers to create arbitrary accounts…

- Severity: High 7.5
- Published: Dec 8, 2025
- Affected: fixed in 0.25.3.
- Fixed in v0.25.3 (released Nov 25, 2025, 13 days before disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2024-21635](https://cve.now/CVE-2024-21635): Memos Access Tokens Stay Valid after User Password Change

- Severity: High 7.1
- Published: Nov 14, 2025
- Affected: all versions; fixed in 0.18.2.
- No fix released. The latest release, v0.31.0, is still affected.

### [CVE-2025-56761](https://cve.now/CVE-2025-56761): Memos 0.22 is vulnerable to Stored Cross site scripting (XSS) vulnerabilities by the upload attachment and user avatar features.

- Severity: Medium 5.4
- Published: Sep 3, 2025
- Affected: all versions; through 0.22.0.
- No fix released. The latest release, v0.31.0, is still affected.

### [CVE-2025-56760](https://cve.now/CVE-2025-56760): When Memos 0.22 is configured to store objects locally, an attacker can create a file via the CreateResource endpoint containing a path…

- Severity: Medium 4.3
- Published: Sep 3, 2025
- Affected: through 0.22.0; all versions.
- No fix released. The latest release, v0.31.0, is still affected.

### [CVE-2025-50738](https://cve.now/CVE-2025-50738): The Memos application, up to version v0.24.3, allows for the embedding of markdown images with arbitrary URLs.

- Severity: Critical 9.8
- Published: Jul 29, 2025
- Affected: fixed in 0.24.4.
- Fixed in v0.24.4 (released Jun 2, 2025, 57 days before disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2025-22952](https://cve.now/CVE-2025-22952): elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, which can…

- Severity: Critical 9.8
- Published: Feb 27, 2025
- Affected: through 0.24.0; all versions.
- No fix released. The latest release, v0.31.0, is still affected.

### [CVE-2023-0109](https://cve.now/CVE-2023-0109): Stored XSS in usememos/memos

- Severity: Critical 9.8
- Published: Nov 15, 2024
- Affected: fixed in 0.10.0.
- Fixed in v0.10.0 (released Jan 7, 2023, 678 days before disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2024-41659](https://cve.now/CVE-2024-41659): GHSL-2024-034: memos CORS Misconfiguration in server.go

- Severity: High 8.1
- Published: Aug 20, 2024
- Affected: fixed in 0.21.0.
- Fixed in v0.21.0 (released Apr 9, 2024, 133 days before disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2024-29029](https://cve.now/CVE-2024-29029): memos vulnerable to an SSRF in /o/get/image

- Severity: Medium 6.1
- Published: Apr 19, 2024
- Affected: fixed in 0.22.0.
- Fixed in v0.22.0 (released May 17, 2024, 28 days after disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2024-29028](https://cve.now/CVE-2024-29028): memos vulnerable to an SSRF in /o/get/httpmeta

- Severity: Medium 5.8
- Published: Apr 19, 2024
- Affected: fixed in 0.16.1.
- Fixed in v0.16.1 (released Oct 21, 2023, 181 days before disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2024-29030](https://cve.now/CVE-2024-29030): memos vulnerable to an SSRF in /api/resource

- Severity: Medium 5.8
- Published: Apr 19, 2024
- Affected: fixed in 0.22.0.
- Fixed in v0.22.0 (released May 17, 2024, 28 days after disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2023-5036](https://cve.now/CVE-2023-5036): Cross-Site Request Forgery (CSRF) in usememos/memos

- Severity: High 7.3
- Published: Sep 18, 2023
- Affected: fixed in 0.15.1.
- Fixed in v0.15.1 (released Sep 18, 2023, the day of disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2023-4697](https://cve.now/CVE-2023-4697): Improper Privilege Management in usememos/memos

- Severity: High 8.8
- Published: Sep 1, 2023
- Affected: fixed in 0.13.2.
- Fixed in v0.13.2 (released Jul 1, 2023, 62 days before disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2023-4698](https://cve.now/CVE-2023-4698): Improper Input Validation in usememos/memos

- Severity: High 7.5
- Published: Sep 1, 2023
- Affected: all versions.
- No fix released. The latest release, v0.31.0, is still affected.

### [CVE-2023-4696](https://cve.now/CVE-2023-4696): Improper Access Control in usememos/memos

- Severity: Critical 9.8
- Published: Sep 1, 2023
- Affected: fixed in 0.13.2.
- Fixed in v0.13.2 (released Jul 1, 2023, 62 days before disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-25978](https://cve.now/CVE-2022-25978): All versions of the package github.com/usememos/memos/server are vulnerable to Cross-site Scripting (XSS) due to insufficient checks on…

- Severity: Medium 5.4
- Published: Feb 15, 2023
- Affected: fixed in 0.10.4-0.20230211093429-b11d2130a084.
- Fixed in v0.11.0 (released Feb 24, 2023, 9 days after disclosure, the advisory names 0.10.4-0.20230211093429-b11d2130a084, which was never published).
- The latest release, v0.31.0, is not affected.

### [CVE-2023-0112](https://cve.now/CVE-2023-0112): Cross-site Scripting (XSS) - Stored in usememos/memos

- Severity: High 7.6
- Published: Jan 7, 2023
- Affected: fixed in 0.10.0.
- Fixed in v0.10.0 (released Jan 7, 2023, the day of disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2023-0111](https://cve.now/CVE-2023-0111): Cross-site Scripting (XSS) - Stored in usememos/memos

- Severity: Medium 5.4
- Published: Jan 7, 2023
- Affected: fixed in 0.10.0.
- Fixed in v0.10.0 (released Jan 7, 2023, the day of disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2023-0110](https://cve.now/CVE-2023-0110): Cross-site Scripting (XSS) - Stored in usememos/memos

- Severity: High 7.1
- Published: Jan 7, 2023
- Affected: fixed in 0.10.0.
- Fixed in v0.10.0 (released Jan 7, 2023, the day of disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2023-0108](https://cve.now/CVE-2023-0108): Cross-site Scripting (XSS) - Stored in usememos/memos

- Severity: High 7.1
- Published: Jan 7, 2023
- Affected: fixed in 0.10.0.
- Fixed in v0.10.0 (released Jan 7, 2023, the day of disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2023-0107](https://cve.now/CVE-2023-0107): Cross-site Scripting (XSS) - Stored in usememos/memos

- Severity: Medium 6.5
- Published: Jan 7, 2023
- Affected: fixed in 0.10.0.
- Fixed in v0.10.0 (released Jan 7, 2023, the day of disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2023-0106](https://cve.now/CVE-2023-0106): Cross-site Scripting (XSS) - Stored in usememos/memos

- Severity: Critical 9.0
- Published: Jan 7, 2023
- Affected: fixed in 0.10.0.
- Fixed in v0.10.0 (released Jan 7, 2023, the day of disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-4866](https://cve.now/CVE-2022-4866): Cross-site Scripting (XSS) - Stored in usememos/memos

- Severity: Critical 9.8
- Published: Dec 31, 2022
- Affected: fixed in 0.9.1.
- Fixed in v0.9.1 (released Dec 31, 2022, the day of disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-4865](https://cve.now/CVE-2022-4865): Cross-site Scripting (XSS) - Stored in usememos/memos

- Severity: High 8.3
- Published: Dec 31, 2022
- Affected: fixed in 0.9.1.
- Fixed in v0.9.1 (released Dec 31, 2022, the day of disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-4863](https://cve.now/CVE-2022-4863): Improper Handling of Insufficient Permissions or Privileges in usememos/memos

- Severity: High 8.4
- Published: Dec 30, 2022
- Affected: fixed in 0.9.1.
- Fixed in v0.9.1 (released Dec 31, 2022, 1 day after disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-4851](https://cve.now/CVE-2022-4851): Improper Handling of Values in usememos/memos

- Severity: Critical 9.8
- Published: Dec 29, 2022
- Affected: fixed in 0.9.1.
- Fixed in v0.9.1 (released Dec 31, 2022, 2 days after disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-4850](https://cve.now/CVE-2022-4850): Cross-Site Request Forgery (CSRF) in usememos/memos

- Severity: Medium 6.5
- Published: Dec 29, 2022
- Affected: through 0.9.0.
- Fixed in v0.9.1 (released Dec 31, 2022, 2 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-4849](https://cve.now/CVE-2022-4849): Cross-Site Request Forgery (CSRF) in usememos/memos

- Severity: High 8.3
- Published: Dec 29, 2022
- Affected: fixed in 0.9.1.
- Fixed in v0.9.1 (released Dec 31, 2022, 2 days after disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-4848](https://cve.now/CVE-2022-4848): Improper Verification of Source of a Communication Channel in usememos/memos

- Severity: High 8.6
- Published: Dec 29, 2022
- Affected: fixed in 0.9.1.
- Fixed in v0.9.1 (released Dec 31, 2022, 2 days after disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-4847](https://cve.now/CVE-2022-4847): Incorrectly Specified Destination in a Communication Channel in usememos/memos

- Severity: High 8.3
- Published: Dec 29, 2022
- Affected: fixed in 0.9.1.
- Fixed in v0.9.1 (released Dec 31, 2022, 2 days after disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-4846](https://cve.now/CVE-2022-4846): Cross-Site Request Forgery (CSRF) in usememos/memos

- Severity: Medium 6.3
- Published: Dec 29, 2022
- Affected: through 0.9.0.
- Fixed in v0.9.1 (released Dec 31, 2022, 2 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-4845](https://cve.now/CVE-2022-4845): Cross-Site Request Forgery (CSRF) in usememos/memos

- Severity: Medium 6.7
- Published: Dec 29, 2022
- Affected: fixed in 0.9.1.
- Fixed in v0.9.1 (released Dec 31, 2022, 2 days after disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-4844](https://cve.now/CVE-2022-4844): Cross-Site Request Forgery (CSRF) in usememos/memos

- Severity: Medium 6.5
- Published: Dec 29, 2022
- Affected: through 0.9.0.
- Fixed in v0.9.1 (released Dec 31, 2022, 2 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-4841](https://cve.now/CVE-2022-4841): Cross-site Scripting (XSS) - Stored in usememos/memos

- Severity: High 8.6
- Published: Dec 29, 2022
- Affected: fixed in 0.9.1.
- Fixed in v0.9.1 (released Dec 31, 2022, 2 days after disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-4840](https://cve.now/CVE-2022-4840): Cross-site Scripting (XSS) - Stored in usememos/memos

- Severity: High 7.6
- Published: Dec 29, 2022
- Affected: fixed in 0.9.1.
- Fixed in v0.9.1 (released Dec 31, 2022, 2 days after disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-4839](https://cve.now/CVE-2022-4839): Cross-site Scripting (XSS) - Stored in usememos/memos

- Severity: High 8.0
- Published: Dec 29, 2022
- Affected: fixed in 0.9.1.
- Fixed in v0.9.1 (released Dec 31, 2022, 2 days after disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-4814](https://cve.now/CVE-2022-4814): Improper Access Control in usememos/memos

- Severity: High 8.6
- Published: Dec 28, 2022
- Affected: fixed in 0.9.1.
- Fixed in v0.9.1 (released Dec 31, 2022, 3 days after disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-4813](https://cve.now/CVE-2022-4813): Insufficient Granularity of Access Control in usememos/memos

- Severity: High 8.6
- Published: Dec 28, 2022
- Affected: fixed in 0.9.1.
- Fixed in v0.9.1 (released Dec 31, 2022, 3 days after disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-4812](https://cve.now/CVE-2022-4812): Authorization Bypass Through User-Controlled Key in usememos/memos

- Severity: High 8.6
- Published: Dec 28, 2022
- Affected: fixed in 0.9.1.
- Fixed in v0.9.1 (released Dec 31, 2022, 3 days after disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-4811](https://cve.now/CVE-2022-4811): Authorization Bypass Through User-Controlled Key in usememos/memos

- Severity: High 8.3
- Published: Dec 28, 2022
- Affected: fixed in 0.9.1.
- Fixed in v0.9.1 (released Dec 31, 2022, 3 days after disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-4810](https://cve.now/CVE-2022-4810): Improper Access Control in usememos/memos

- Severity: Medium 6.3
- Published: Dec 28, 2022
- Affected: fixed in 0.9.1.
- Fixed in v0.9.1 (released Dec 31, 2022, 3 days after disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-4809](https://cve.now/CVE-2022-4809): Improper Access Control in usememos/memos

- Severity: High 8.3
- Published: Dec 28, 2022
- Affected: fixed in 0.9.1.
- Fixed in v0.9.1 (released Dec 31, 2022, 3 days after disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-4808](https://cve.now/CVE-2022-4808): Improper Privilege Management in usememos/memos

- Severity: Medium 4.2
- Published: Dec 28, 2022
- Affected: fixed in 0.9.1.
- Fixed in v0.9.1 (released Dec 31, 2022, 3 days after disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-4807](https://cve.now/CVE-2022-4807): Improper Access Control in usememos/memos

- Severity: High 8.2
- Published: Dec 28, 2022
- Affected: fixed in 0.9.1.
- Fixed in v0.9.1 (released Dec 31, 2022, 3 days after disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-4806](https://cve.now/CVE-2022-4806): Authorization Bypass Through User-Controlled Key in usememos/memos

- Severity: High 8.2
- Published: Dec 28, 2022
- Affected: fixed in 0.9.1.
- Fixed in v0.9.1 (released Dec 31, 2022, 3 days after disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-4805](https://cve.now/CVE-2022-4805): Incorrect Use of Privileged APIs in usememos/memos

- Severity: High 7.3
- Published: Dec 28, 2022
- Affected: fixed in 0.9.1.
- Fixed in v0.9.1 (released Dec 31, 2022, 3 days after disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-4804](https://cve.now/CVE-2022-4804): Improper Authorization in usememos/memos

- Severity: High 8.2
- Published: Dec 28, 2022
- Affected: fixed in 0.9.1.
- Fixed in v0.9.1 (released Dec 31, 2022, 3 days after disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-4803](https://cve.now/CVE-2022-4803): Authorization Bypass Through User-Controlled Key in usememos/memos

- Severity: High 8.1
- Published: Dec 28, 2022
- Affected: fixed in 0.9.1.
- Fixed in v0.9.1 (released Dec 31, 2022, 3 days after disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-4802](https://cve.now/CVE-2022-4802): Authorization Bypass Through User-Controlled Key in usememos/memos

- Severity: Critical 9.1
- Published: Dec 28, 2022
- Affected: fixed in 0.9.1.
- Fixed in v0.9.1 (released Dec 31, 2022, 3 days after disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-4801](https://cve.now/CVE-2022-4801): Insufficient Granularity of Access Control in usememos/memos

- Severity: High 8.2
- Published: Dec 28, 2022
- Affected: fixed in 0.9.1.
- Fixed in v0.9.1 (released Dec 31, 2022, 3 days after disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-4800](https://cve.now/CVE-2022-4800): Improper Verification of Source of a Communication Channel in usememos/memos

- Severity: High 8.6
- Published: Dec 28, 2022
- Affected: fixed in 0.9.1.
- Fixed in v0.9.1 (released Dec 31, 2022, 3 days after disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-4799](https://cve.now/CVE-2022-4799): Authorization Bypass Through User-Controlled Key in usememos/memos

- Severity: High 8.6
- Published: Dec 28, 2022
- Affected: fixed in 0.9.1.
- Fixed in v0.9.1 (released Dec 31, 2022, 3 days after disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-4798](https://cve.now/CVE-2022-4798): Authorization Bypass Through User-Controlled Key in usememos/memos

- Severity: High 8.6
- Published: Dec 28, 2022
- Affected: fixed in 0.9.1.
- Fixed in v0.9.1 (released Dec 31, 2022, 3 days after disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-4797](https://cve.now/CVE-2022-4797): Improper Restriction of Excessive Authentication Attempts in usememos/memos

- Severity: Critical 9.8
- Published: Dec 28, 2022
- Affected: fixed in 0.9.1.
- Fixed in v0.9.1 (released Dec 31, 2022, 3 days after disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-4796](https://cve.now/CVE-2022-4796): Incorrect Use of Privileged APIs in usememos/memos

- Severity: High 8.1
- Published: Dec 28, 2022
- Affected: fixed in 0.9.1.
- Fixed in v0.9.1 (released Dec 31, 2022, 3 days after disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-4767](https://cve.now/CVE-2022-4767): Denial of Service in usememos/memos

- Severity: High 7.6
- Published: Dec 27, 2022
- Affected: fixed in 0.9.1.
- Fixed in v0.9.1 (released Dec 31, 2022, 4 days after disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-4734](https://cve.now/CVE-2022-4734): Improper Removal of Sensitive Information Before Storage or Transfer in usememos/memos

- Severity: High 8.1
- Published: Dec 25, 2022
- Affected: fixed in 0.9.1.
- Fixed in v0.9.1 (released Dec 31, 2022, 6 days after disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-4695](https://cve.now/CVE-2022-4695): Cross-site Scripting (XSS) - Stored in usememos/memos

- Severity: High 7.6
- Published: Dec 23, 2022
- Affected: fixed in 0.9.0.
- Fixed in v0.9.0 (released Dec 23, 2022, the day of disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-4694](https://cve.now/CVE-2022-4694): Cross-site Scripting (XSS) - Stored in usememos/memos

- Severity: Medium 5.7
- Published: Dec 23, 2022
- Affected: fixed in 0.9.0.
- Fixed in v0.9.0 (released Dec 23, 2022, the day of disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-4692](https://cve.now/CVE-2022-4692): Cross-site Scripting (XSS) - Stored in usememos/memos

- Severity: High 7.1
- Published: Dec 23, 2022
- Affected: fixed in 0.9.0.
- Fixed in v0.9.0 (released Dec 23, 2022, the day of disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-4691](https://cve.now/CVE-2022-4691): Cross-site Scripting (XSS) - Stored in usememos/memos

- Severity: High 8.3
- Published: Dec 23, 2022
- Affected: fixed in 0.9.0.
- Fixed in v0.9.0 (released Dec 23, 2022, the day of disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-4690](https://cve.now/CVE-2022-4690): Cross-site Scripting (XSS) - Stored in usememos/memos

- Severity: High 7.1
- Published: Dec 23, 2022
- Affected: fixed in 0.9.0.
- Fixed in v0.9.0 (released Dec 23, 2022, the day of disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-4689](https://cve.now/CVE-2022-4689): Improper Access Control in usememos/memos

- Severity: High 8.3
- Published: Dec 23, 2022
- Affected: fixed in 0.9.0.
- Fixed in v0.9.0 (released Dec 23, 2022, the day of disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-4688](https://cve.now/CVE-2022-4688): Improper Authorization in usememos/memos

- Severity: High 8.8
- Published: Dec 23, 2022
- Affected: fixed in 0.9.0.
- Fixed in v0.9.0 (released Dec 23, 2022, the day of disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-4687](https://cve.now/CVE-2022-4687): Incorrect Use of Privileged APIs in usememos/memos

- Severity: High 8.1
- Published: Dec 23, 2022
- Affected: fixed in 0.9.0.
- Fixed in v0.9.0 (released Dec 23, 2022, the day of disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-4686](https://cve.now/CVE-2022-4686): Authorization Bypass Through User-Controlled Key in usememos/memos

- Severity: High 8.6
- Published: Dec 23, 2022
- Affected: fixed in 0.9.0.
- Fixed in v0.9.0 (released Dec 23, 2022, the day of disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-4684](https://cve.now/CVE-2022-4684): Improper Access Control in usememos/memos

- Severity: High 7.6
- Published: Dec 23, 2022
- Affected: fixed in 0.9.0.
- Fixed in v0.9.0 (released Dec 23, 2022, the day of disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-4683](https://cve.now/CVE-2022-4683): Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in usememos/memos

- Severity: Medium 4.3
- Published: Dec 23, 2022
- Affected: fixed in 0.9.0.
- Fixed in v0.9.0 (released Dec 23, 2022, the day of disclosure).
- The latest release, v0.31.0, is not affected.

### [CVE-2022-4609](https://cve.now/CVE-2022-4609): Cross-site Scripting (XSS) - Stored in usememos/memos

- Severity: High 7.6
- Published: Dec 19, 2022
- Affected: through 0.8.3.
- Fixed in v0.9.0 (released Dec 23, 2022, 4 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, v0.31.0, is not affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/go/github.com/usememos/memos
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.