CVE-2026-113601Published
Memos before 0.27.0 Missing Authorization via ActivityService ListActivities/GetActivity
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-113601 · Microsoft / collected KEV context
cve-program · CVE-2026-113601
- https://github.com/usememos/memos/issues/5651
- https://github.com/usememos/memos/commit/04f239a2fc74f7090c779a6a7b8a08238fd31b88
- https://github.com/usememos/memos/releases/tag/v0.27.0
- https://github.com/usememos/memos/blob/v0.26.2/server/router/api/v1/activity_service.go
- https://www.vulncheck.com/advisories/memos-before-0.27.0-missing-authorization-via-activityservice-listactivities-getactivity
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.