Is CVE-2026-6634 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6634 being exploited in the wild.

How severe is CVE-2026-6634?

Medium severity, with a CVSS score of 6.3, published 20 April 2026.

Which products and versions are affected?

github.com/usememos/memos (Go) <= 0.22.1, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=0.22.1; Usememos Memos <= 0.22.1.

Is there a fix for CVE-2026-6634?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-6634 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-6634?

Check whether you run github.com/usememos/memos (Go) or Usememos Memos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6634: usememos Memos incorrect privilege assignment in UpdateInstanceSetting

Q: Is there a fix for CVE-2026-6634?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-6634 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-6634?

Check whether you run github.com/usememos/memos (Go) or Usememos Memos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6634 · Severity: medium · CVSS 6.3 · Published 2026-04-20

Memos, an open-source note-taking and knowledge management solution, contains a security flaw in how it handles user permissions for instance settings. An attacker with a standard user account can exploit this to modify system-wide styles or scripts, potentially leading to unauthorized changes to the application's appearance or behavior. This could impact the integrity of the platform and the privacy of other users' data.

Technologies: github.com/usememos/memos (Go), Usememos Memos. Vendors: Go, Usememos.

Quick answers

Is CVE-2026-6634 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6634 being exploited in the wild.
How severe is CVE-2026-6634?: Medium severity, with a CVSS score of 6.3, published 20 April 2026.
Which products and versions are affected?: github.com/usememos/memos (Go) <= 0.22.1, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=0.22.1; Usememos Memos <= 0.22.1.
Is there a fix for CVE-2026-6634?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-6634 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-6634?: Check whether you run github.com/usememos/memos (Go) or Usememos Memos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An incorrect privilege assignment vulnerability (CWE-266) exists in Memos up to version 0.22.1. The flaw is located in the UpdateInstanceSetting component within src/App.tsx, specifically affecting the memos_access_token function. By manipulating the additionalStyle and additionalScript arguments, a remote attacker with low privileges can bypass intended authorization checks. This allows for unauthorized modification of instance-level settings. A public exploit has been released, and as of the advisory date, no official patch has been provided by the vendor.

Affected products

usememos Memos <= 0.22.1

Identifiers

CVE-2026-6634
GHSA-gqp3-hfc3-8q54
GO-2026-5403

Timeline

2026-04-20: disclosed
2026-04-20: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.