GHSA-gqp3-hfc3-8q54

Source

https://github.com/advisories/GHSA-gqp3-hfc3-8q54

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-gqp3-hfc3-8q54/GHSA-gqp3-hfc3-8q54.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-gqp3-hfc3-8q54

Aliases

CVE-2026-6634
GO-2026-5403

Published

2026-04-20T12:32:01Z

Modified

2026-07-21T15:00:40Z

Severity

6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

Memos has an Incorrect Privilege Assignment issue

Details

A weakness has been identified in usememos memos up to 0.22.1. This affects the function memos_access_token of the file src/App.tsx of the component UpdateInstanceSetting. This manipulation of the argument additionalStyle/additionalScript causes improper authorization. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Database specific

{
    "cwe_ids":  [
        "CWE-266"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-04-28T23:21:49Z",
    "nvd_published_at":  "2026-04-20T12:16:09Z",
    "severity":  "LOW"
}

References

Affected packages

Go / github.com/usememos/memos

Package

Name: github.com/usememos/memos; View open source insights on deps.dev
Purl: pkg:golang/github.com/usememos/memos

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

0.22.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-gqp3-hfc3-8q54/GHSA-gqp3-hfc3-8q54.json"