# CVE-2026-6634: usememos Memos incorrect privilege assignment in UpdateInstanceSetting

Source: https://junglewise.ai/threats/cve-2026-6634-usememos-memos-incorrect-privilege-assignment-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-20. Updated: 2026-07-21  
License: CC BY 4.0 with a link back

CVE-2026-6634 · Severity: medium · CVSS 6.3 · Published 2026-04-20

Memos, an open-source note-taking and knowledge management solution, contains a security flaw in how it handles user permissions for instance settings. An attacker with a standard user account can exploit this to modify system-wide styles or scripts, potentially leading to unauthorized changes to the application's appearance or behavior. This could impact the integrity of the platform and the privacy of other users' data.

Technologies: [github.com/usememos/memos (Go)](https://junglewise.ai/threats/technologies/github-com-usememos-memos), [Usememos Memos](https://junglewise.ai/threats/technologies/memos). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Usememos](https://junglewise.ai/threats/vendors/usememos).

## Quick answers

**Is CVE-2026-6634 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6634 being exploited in the wild.

**How severe is CVE-2026-6634?** Medium severity, with a CVSS score of 6.3, published 20 April 2026.

**Which products and versions are affected?** github.com/usememos/memos (Go) <= 0.22.1, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=0.22.1; Usememos Memos <= 0.22.1.

**Is there a fix for CVE-2026-6634?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-6634 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-6634?** Check whether you run github.com/usememos/memos (Go) or Usememos Memos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An incorrect privilege assignment vulnerability (CWE-266) exists in Memos up to version 0.22.1. The flaw is located in the UpdateInstanceSetting component within src/App.tsx, specifically affecting the memos_access_token function. By manipulating the additionalStyle and additionalScript arguments, a remote attacker with low privileges can bypass intended authorization checks. This allows for unauthorized modification of instance-level settings. A public exploit has been released, and as of the advisory date, no official patch has been provided by the vendor.

## Affected products

- usememos Memos <= 0.22.1

## Identifiers

- CVE-2026-6634
- GHSA-gqp3-hfc3-8q54
- GO-2026-5403

## Timeline

- 2026-04-20: disclosed
- 2026-04-20: advisory

## References

- [https://github.com/Dave-gilmore-aus/security-advisories/blob/main/usememos-security-advisory](https://github.com/Dave-gilmore-aus/security-advisories/blob/main/usememos-security-advisory)
- [https://vuldb.com/submit/793432](https://vuldb.com/submit/793432)
- [https://vuldb.com/vuln/358268](https://vuldb.com/vuln/358268)
- [https://vuldb.com/vuln/358268/cti](https://vuldb.com/vuln/358268/cti)

## Related threats

- [Memos missing authorization in ActivityService API methods](https://junglewise.ai/threats/cve-2026-113601-memos-before-0-27-0-contains-a-missing-authorization)
- [Memos link-metadata fetcher SSRF via missing carrier-grade NAT range](https://junglewise.ai/threats/cve-2026-82476-memos-link-metadata-fetcher-ssrf-via-missing-carrier-grade-nat)
- [usememos Memos SSO account takeover via identifier mismatch](https://junglewise.ai/threats/cve-2026-51584-usememos-memos-sso-account-takeover-via-identifier-mismatch)
- [Memos Server-Side Request Forgery in webhook validation](https://junglewise.ai/threats/cve-2026-51583-memos-server-side-request-forgery-in-webhook-validation)
- [usememos Memos HTML injection and UI redressing in SANITIZE_SCHEMA](https://junglewise.ai/threats/cve-2026-30586-usememos-memos-html-injection-and-ui-redressing-in-sanitize)