6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-65797

CVE-2025-65797: memos vulnerability allows arbitrarily modification or deletion registered identity providers

Incorrect access control in the Identity Provider service of usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify or delete registered identity providers, leading to an account takeover or Denial of Service (DoS).

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-65797

CVE-2025-65797:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/usememos/memos	go	< 0.25.3	0.25.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the Identity Provider (IdP) service of memos, where several API endpoints lacked proper authorization checks. The analysis of the security patch 769dcd0cf9be83d472829f6e7903b201e42f6b3c reveals the root cause.

The functions APIV1Service.UpdateIdentityProvider and APIV1Service.DeleteIdentityProvider in server/router/api/v1/idp_service.go did not verify if the calling user had the administrative privileges required to perform these actions. Before the patch, any authenticated user could send a request to these endpoints and modify or delete IdP configurations. The patch rectifies this by adding a check to ensure the user has the store.RoleHost role, effectively restricting these operations to administrators.

Additionally, the APIV1Service.GetIdentityProvider and APIV1Service.ListIdentityProviders functions were found to leak sensitive OAuth2 client_secret values to any authenticated user. The patch addresses this information disclosure by introducing a new function, redactIdentityProviderResponse, which removes the client_secret from the response for users who do not have the store.RoleHost role.

Exploitation of these vulnerabilities would allow an attacker with a low-privilege account to either cause a Denial of Service (by deleting IdPs) or potentially achieve account takeover (by modifying an IdP to point to an attacker-controlled authentication server).

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.