4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-65796

CVE-2025-65796: memos vulnerability allows arbitrarily reactions deletion

Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily delete reactions made to other users' Memos.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-65796

CVE-2025-65796:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/usememos/memos	go	< 0.25.3	0.25.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is rooted in improper access control across multiple API endpoints in the usememos/memos application. The security patch, identified by commit 769dcd0cf9be83d472829f6e7903b201e42f6b3c, reveals several instances where authorization checks were missing.

The most critical vulnerability, and the one highlighted by the CVE description, is in the APIV1Service.DeleteMemoReaction function. Before the patch, this function did not validate whether the user initiating the delete request was the creator of the reaction. This allowed any authenticated user, regardless of their privilege level, to delete reactions created by other users, leading to a denial of service or data manipulation scenario.

The patch addresses this by introducing an ownership check, ensuring that only the user who created the reaction or a superuser can delete it.

Furthermore, the analysis of the commit revealed that similar authorization flaws existed in other functions:

SetMemoAttachments and SetMemoRelations allowed users to modify memos they did not own.
UpdateIdentityProvider and DeleteIdentityProvider could be executed by any authenticated user, not just administrators (Host role).
GetIdentityProvider and ListIdentityProviders exposed sensitive OAuth2 client secrets to non-administrative users.

All these issues were fixed in the same commit by adding the appropriate user ownership or role-based access control checks. Therefore, exploiting this CVE would involve making a call to one of these vulnerable API endpoints, with DeleteMemoReaction being the primary example.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.