GHSA-ghx2-6v4g-9wmmHighCVSS 8.1

usememos/memos makes Incorrect Use of Privileged APIs

Published
December 28, 2022
Last Modified
February 3, 2023

🔗 CVE IDs covered (1)

CVE-2022-4796 →

📋 Description

In usememos/memos 0.9.0 and prior, a user with login permission can delete all notes of the whole application via API DELETE https://demo.usememos.com/api/memo/$idnote. The vulnerability will lose all user notes data throughout the system, causing damage to user data.

🎯 Affected products1

  • go/github.com/usememos/memos:<= 0.9.0

🔗 References (4)