~ / search / GHSA-99m2-qwx6-2w6f

GHSA-99m2-qwx6-2w6f

memos vulnerability allows arbitrarily modification or deletion registered identity providers

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-65797

Packages

EcosystemPackageAffectedFixed in
Go github.com/usememos/memos < 0.25.3 0.25.3

Details

As written in the advisory (Markdown source, shown as plain text).

Incorrect access control in the Identity Provider service of usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify or delete registered identity providers, leading to an account takeover or Denial of Service (DoS).

References

External links from the advisory. They lead to third-party sites.