CVE-2026-113601

Memos before 0.27.0 contains a missing authorization vulnerability in the ActivityService ListActivities and GetActivity API methods that allows authenticated users to view all users' activity records. Low-privileged attackers can enumerate sequential activity IDs to obtain creator IDs, timestamp...

CVE-2026-113601 Memos before 0.27.0 Missing Authorization via ActivityService ListActivities/GetActivity

Memos before 0.27.0 contains a missing authorization vulnerability in the ActivityService ListActivities and GetActivity API methods that allows authenticated users to view all users' activity records. Low-privileged attackers can enumerate sequential activity IDs to obtain creator IDs, timestamp...

EUVD-2026-105167

Memos before 0.27.0 contains a missing authorization vulnerability in the ActivityService ListActivities and GetActivity API methods that allows authenticated users to view all users' activity records. Low-privileged attackers can enumerate sequential activity IDs to obtain creator IDs, timestamp...

CVE-2026-113601

Versions of Memos prior to 0.27.0 are vulnerable to a missing authorization flaw in the ActivityService ListActivities and GetActivity API methods. This vulnerability allows authenticated users to view activity records from all other users by enumerating sequential activity IDs. Impacted data inc...