Is CVE-2025-65795 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-65795 being exploited in the wild.

How severe is CVE-2025-65795?

High severity, with a CVSS score of 7.5, published 8 December 2025.

Which products and versions are affected?

github.com/usememos/memos (Go) SEMVER:introduced=0,fixed=0.25.3; Usememos Memos 0.25.2.

Is there a fix for CVE-2025-65795?

Yes. github.com/usememos/memos (Go): upgrade to 0.25.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-65795 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-65795?

Check whether you run github.com/usememos/memos (Go) or Usememos Memos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-65795: usememos memos incorrect access control in user registration API

CVE-2025-65795 · Severity: high · CVSS 7.5 · Published 2025-12-08

A vulnerability in the Memos note-taking application allows unauthorized individuals to create new user accounts even when the administrator has disabled public registration. This flaw bypasses intended security settings, potentially allowing attackers to gain a foothold in the system. Once an account is created, it can be used as a starting point for further attacks, such as unauthorized data access or system compromise.

Technologies: github.com/usememos/memos (Go), Usememos Memos. Vendors: Go, Usememos.

Quick answers

Is CVE-2025-65795 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-65795 being exploited in the wild.
How severe is CVE-2025-65795?: High severity, with a CVSS score of 7.5, published 8 December 2025.
Which products and versions are affected?: github.com/usememos/memos (Go) SEMVER:introduced=0,fixed=0.25.3; Usememos Memos 0.25.2.
Is there a fix for CVE-2025-65795?: Yes. github.com/usememos/memos (Go): upgrade to 0.25.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-65795 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-65795?: Check whether you run github.com/usememos/memos (Go) or Usememos Memos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/usememos/memos (Go): upgrade to 0.25.3 or later
```
go get github.com/usememos/memos@v0.25.3
```

Technical details

A broken access control vulnerability exists in the REST API of usememos memos v0.25.2. The application fails to enforce the 'Disallow user registration' administrative setting within the `/api/v1/users` endpoint. An unauthenticated remote attacker can bypass the frontend registration restrictions by sending a direct POST request to the API with a chosen username and password. This allows for unauthorized account creation, which can subsequently be leveraged to perform authenticated-only attacks, such as arbitrary file writes or account takeovers. The issue was addressed in version 0.25.3 by adding authorization checks to the user registration service.

Affected products

usememos memos 0.25.2

Identifiers

CVE-2025-65795
GHSA-mg56-wc4q-rw4w
GO-2025-4217

Timeline

2025-11-03: disclosed: First contact with vendor by researcher
2025-11-04: other: Pull request submitted
2025-11-06: patched: Fix merged to main branch
2025-11-25: other: Version 0.25.3 released
2025-12-03: advisory: Researcher advisory published
2025-12-08: other: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.