Vulnerability · Published Apr 20, 2026 · Assigned by VulDB

CVE-2026-6634usememos UpdateInstanceSetting App.tsx memos_access_token improper authorization

Medium 6.3

In plain English

A medium-severity security flaw in memos from usememos. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.3%top 83.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A weakness has been identified in usememos memos up to 0.22.1. This affects the function memos_access_token of the file src/App.tsx of the component UpdateInstanceSetting. This manipulation of the argument additionalStyle/additionalScript causes improper authorization. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/usememos/memos	no fix listed	GO-2026-5403
Go	github.com/usememos/memos	no fix listed	GHSA-gqp3-hfc3-8q54

Affected products (as reported)

Vendor	Product	Versions
usememos	memos	0.22.00.22.1

Weakness: CWE-285, CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-358268 | usememos UpdateInstanceSetting App.tsx memos_access_token improper authorization vdb-entry, technical-description
VDB-358268 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #793432 | Usememos Memos 0.22.1 Cross Site Scripting third-party-advisory
https://github.com/Dave-gilmore-aus/security-advisories/blob/main/usememos-security-advisory exploit