Description
Memos before 0.27.0 contains a missing authorization vulnerability in the ActivityService ListActivities and GetActivity API methods that allows authenticated users to view all users' activity records. Low-privileged attackers can enumerate sequential activity IDs to obtain creator IDs, timestamps, and memo-comment references, including activity on other users' private memos.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
usememos memos
Default version status: unaffected
0 to < 0.27.0affected
pkg:golang/github.com/usememos/memosReferences
- https://github.com/usememos/memos/issues/5651 ↗
- https://github.com/usememos/memos/commit/04f239a2fc74f7090c779a6a7b8a08238fd31b88 ↗
- https://github.com/usememos/memos/releases/tag/v0.27.0 ↗
- https://github.com/usememos/memos/blob/v0.26.2/server/router/api/v1/activity_service.go ↗
- https://www.vulncheck.com/advisories/memos-before-0.27.0-missing-authorization-via-activityservice-listactivities-getactivity ↗