Executive brief
Memos is an open-source note-taking application that allows users to configure webhooks to trigger external HTTP requests when memo events occur. An authenticated attacker can bypass the webhook URL validation mechanism by pointing webhooks at internal network addresses (e.g., 0.0.0.0, CGNAT ranges, or link-local addresses), causing the Memos server to make HTTP POST requests to services that should not be accessible from outside the internal network, potentially exposing or compromising cloud metadata endpoints, internal admin panels, or other containerized services.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) in the webhook validation mechanism (internal/webhook/validate.go). The isReservedIP() predicate used to block internal addresses maintains an incomplete reservedCIDRs list that omits 0.0.0.0/8 (unspecified), ::/128 (IPv6 unspecified), 100.64.0.0/10 (CGNAT), 192.0.0.0/24 (IETF protocol assignments), 198.18.0.0/15 (benchmarking), and multicast ranges. An authenticated user can register a webhook targeting any of these omitted ranges; when a memo event fires, the backend dispatches an HTTP POST from within the internal network boundary to the attacker-specified address. The predicate is reused at both registration and dispatch time, so a gap in the list bypasses both validation layers simultaneously. No patch was available as of v0.30.0; the advisory recommends using Go's built-in net.IP predicates (IsUnspecified, IsLoopback, IsPrivate, IsLinkLocalUnicast) combined with explicit blocks for the omitted CIDR ranges.
Affected products
- usememos Memos through v0.30.0
Timeline
- 2026-08-11: disclosed: CVE-2026-51583 published; no upstream patch available at time of publication
- 2026-02-23: other: Incomplete SSRF remediation introduced in v0.26.2/v0.27.0 (commit 150371d2)