{"id":"EUVD-2025-201722","enisaUuid":"34ac34bb-b2d4-3f1b-8edf-4e5c2a855a85","description":"Incorrect access control in the Identity Provider service of usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify or delete registered identity providers, leading to an account takeover or Denial of Service (DoS).","datePublished":"Dec 8, 2025, 12:00:00 AM","dateUpdated":"Jul 5, 2026, 4:12:35 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/usememos/memos/pull/5217\nhttps://herolab.usd.de/security-advisories/usd-2025-0057/\n","aliases":"CVE-2025-65797\nGHSA-99m2-qwx6-2w6f\n","assigner":"mitre","epss":0.28,"enisaIdProduct":[{"id":"d2bd12dc-c814-3baa-b510-af8f03bae4c7","product":{"name":"n/a","vendor":{"name":"n/a"}},"product_version":"n/a"}],"enisaIdVendor":[{"id":"dbc99b58-b846-3e5d-949d-56070c8d199a","vendor":{"name":"n/a"}}],"enisaIdVulnerability":[{"id":"2bd1bff3-baa9-39e5-9ed0-14afc4991361","vulnerability":{"id":"CVE-2025-65797","description":"Incorrect access control in the Identity Provider service of usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify or delete registered identity providers, leading to an account takeover or Denial of Service (DoS).","datePublished":"Dec 8, 2025, 12:00:00 AM","dateUpdated":"Jul 5, 2026, 4:12:35 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/usememos/memos/pull/5217\nhttps://herolab.usd.de/security-advisories/usd-2025-0057/\n","enisa_id":"EUVD-2025-201722\n","assigner":"mitre","epss":0.28,"dataProcessed":"Oct 29, 2026, 7:19:45 AM","vulnerabilityProduct":[{"id":"7ee94d4c-f732-3d27-a119-635f75335f2e","product":{"name":"n/a","vendor":{"name":"n/a"}},"product_version":"n/a"}],"vulnerabilityVendor":[{"id":"f9d741e9-5d55-3cec-a22d-1137e0048391","vendor":{"name":"n/a"}}]}},{"id":"56cd44ce-de92-3bda-a03d-8bcf6aec1938","vulnerability":{"id":"GHSA-99m2-qwx6-2w6f","description":"memos vulnerability allows arbitrarily modification or deletion registered identity providers","datePublished":"Dec 8, 2025, 6:30:44 PM","dateUpdated":"Dec 17, 2025, 1:11:40 AM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2025-65797\nhttps://github.com/usememos/memos/pull/5217\nhttps://github.com/usememos/memos/commit/769dcd0cf9be83d472829f6e7903b201e42f6b3c\nhttps://github.com/advisories/GHSA-99m2-qwx6-2w6f\nhttps://github.com/usememos/memos\nhttps://herolab.usd.de/security-advisories/usd-2025-0057\nhttp://memos.com\nhttp://usememos.com\n","enisa_id":"EUVD-2025-201722\n","aliases":"GHSA-99m2-qwx6-2w6f\nCVE-2025-65797\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:51:54 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}