usememos/memos vulnerable to improper access control

published 2022-12-23 3y ago modified 2026-03-03 8mo ago also CVE-2022-4685 , GO-2022-1205

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

Improper Access Control in GitHub repository usememos/memos prior to 0.9.0.

Patch / fix

fixed in 1 links 1

go github.com/usememos/memos 0.9.0

github.com/usememos/memos@dca35bd commit

Is GHSA-9v48-2h5x-fvpm in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
go	github.com/usememos/memos	<0.9.0	0.9.0

Classification

Weakness

CWE-284 Improper Access Control

References

github.com /usememos/memos/commit/dca35bde877aab6e64ef51b52e590b5d48f692f9
web, patch
nvd.nist.gov /vuln/detail/CVE-2022-4685
advisory
github.com /usememos/memos
package
huntr.dev /bounties/015dbf52-8924-4aad-86d7-892cb61157af
web
github.com /advisories/GHSA-9v48-2h5x-fvpm
advisory

Sources

GitHub Advisory GHSA-9v48-2h5x-fvpm
OSV GO-2022-1205

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.