-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGoMiggo AIRoot Cause AnalysisThe vulnerability stems from incomplete data sanitization in system status responses. The commit 05b41804e33a specifically modifies the registerSystemRoutes function in server/system.go to add email field redaction. Before this patch, while OpenID was cleared, email remained in responses. This function handles authentication-gated system information endpoints, making it the logical point of exposure for authenticated user data leaks. The CWE-212 mapping confirms this is an improper sensitive data removal issue during response preparation.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/usememos/memos | go | <= 0.9.0 | 0.9.1 |