What is CVE-2026-113601?

CVE-2026-113601 is a medium-severity vulnerability in Usememos Memos, classified under Missing Authorization. CVSS score: 4.3/10. Published 2026-10-20.

How severe is CVE-2026-113601?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Auth bypass in Usememos Memos

CVE-2026-113601

Memos before 0.27.0 contains a missing authorization vulnerability in the ActivityService ListActivities and GetActivity API methods that allows authenticated users to view all users' activity records. Low-privileged attackers can enumerate sequential activity IDs to obtain creator IDs, timestamps, and memo-comment references, including activity on other users' private memos.

Vulnerability class: Broken Access Control

Published 2026-10-20 · last modified 2026-10-20.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Usememos Memos

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

github.com/usememos/memos/issues/5651 (issue-tracking)
github.com/usememos/memos/commit/04f239a2fc74f7090c779a6a7b8a08238fd31b88 (patch)
github.com/usememos/memos/releases/tag/v0.27.0 (release-notes)
github.com/usememos/memos/blob/v0.26.2/server/router/api/v1/activity_service.go (technical-description)
www.vulncheck.com/advisories/memos-before-0.27.0-missing-authorization-via-acti… (third-party-advisory)

Frequently asked questions

What is CVE-2026-113601?: CVE-2026-113601 is a medium-severity vulnerability in Usememos Memos, classified under Missing Authorization. CVSS score: 4.3/10. Published 2026-10-20.
How severe is CVE-2026-113601?: Medium severity. CVSS v3 base score is 4.3 out of 10.