5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-65798

CVE-2025-65798: memos vulnerability allows arbitrarily modification or deletion of attachments

Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify or delete attachments made by other users.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-65798

CVE-2025-65798:

5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/usememos/memos	go	< 0.25.3	0.25.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The security vulnerability, described as allowing arbitrary modification or deletion of attachments, is primarily addressed in the APIV1Service.SetMemoAttachments function within server/router/api/v1/memo_attachment_service.go. Before the patch, this function failed to check if the requesting user was the owner of the memo, thus permitting any authenticated user to alter attachments on any memo. The fix introduces a crucial authorization check, restricting this action to the memo's creator or a superuser.

The associated commit, however, reveals a broader pattern of missing authorization checks across multiple API services. The patch addresses several other improper access control vulnerabilities:

APIV1Service.SetMemoRelations: Similar to the attachment issue, it allowed any user to modify memo relationships.
APIV1Service.DeleteMemoReaction: Allowed any user to delete another user's reaction.
APIV1Service.UpdateIdentityProvider and APIV1Service.DeleteIdentityProvider: These administrative functions were exposed to all authenticated users.
APIV1Service.GetIdentityProvider and APIV1Service.ListIdentityProviders: These functions leaked sensitive OAuth2 client secrets to non-administrative users.

The root cause across all these functions was the absence of proper authorization logic to verify user permissions before executing sensitive operations. The patch systematically adds these checks, ensuring that actions are only performed by users with the appropriate roles and ownership.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.