Executive brief
Memos, an open-source note-taking and knowledge management solution, contains a security flaw in how it handles user permissions for instance settings. An attacker with a standard user account can exploit this to modify system-wide styles or scripts, potentially leading to unauthorized changes to the application's appearance or behavior. This could impact the integrity of the platform and the privacy of other users' data.
Technical details
An incorrect privilege assignment vulnerability (CWE-266) exists in Memos up to version 0.22.1. The flaw is located in the UpdateInstanceSetting component within src/App.tsx, specifically affecting the memos_access_token function. By manipulating the additionalStyle and additionalScript arguments, a remote attacker with low privileges can bypass intended authorization checks. This allows for unauthorized modification of instance-level settings. A public exploit has been released, and as of the advisory date, no official patch has been provided by the vendor.
Affected products
- usememos Memos <= 0.22.1
Timeline
- 2026-04-20: disclosed
- 2026-04-20: advisory