Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-u661-g7wy-h3dv
Vulnerability ID VCID-u661-g7wy-h3dv
Aliases CVE-2025-65797
GHSA-99m2-qwx6-2w6f
Summary Incorrect access control in the Identity Provider service of usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify or delete registered identity providers, leading to an account takeover or Denial of Service (DoS).
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-284 Improper Access Control
System Score Found at
cvssv3.1 6.5 http://memos.com
generic_textual MODERATE http://memos.com
ssvc Track http://memos.com
epss 0.00129 https://api.first.org/data/v1/epss?cve=CVE-2025-65797
epss 0.00129 https://api.first.org/data/v1/epss?cve=CVE-2025-65797
cvssv3.1 6.5 https://github.com/advisories/GHSA-99m2-qwx6-2w6f
generic_textual MODERATE https://github.com/advisories/GHSA-99m2-qwx6-2w6f
cvssv3.1 6.5 https://github.com/usememos/memos
generic_textual MODERATE https://github.com/usememos/memos
cvssv3.1 6.5 https://github.com/usememos/memos/commit/769dcd0cf9be83d472829f6e7903b201e42f6b3c
generic_textual MODERATE https://github.com/usememos/memos/commit/769dcd0cf9be83d472829f6e7903b201e42f6b3c
cvssv3.1 6.5 https://github.com/usememos/memos/pull/5217
generic_textual MODERATE https://github.com/usememos/memos/pull/5217
ssvc Track https://github.com/usememos/memos/pull/5217
cvssv3.1 6.5 https://herolab.usd.de/security-advisories/usd-2025-0057
generic_textual MODERATE https://herolab.usd.de/security-advisories/usd-2025-0057
cvssv3.1 6.5 https://herolab.usd.de/security-advisories/usd-2025-0057/
ssvc Track https://herolab.usd.de/security-advisories/usd-2025-0057/
cvssv3.1 6.5 https://nvd.nist.gov/vuln/detail/CVE-2025-65797
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2025-65797
cvssv3.1 6.5 http://usememos.com
generic_textual MODERATE http://usememos.com
ssvc Track http://usememos.com
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2025-65797
https://github.com/advisories/GHSA-99m2-qwx6-2w6f
https://github.com/usememos/memos/commit/769dcd0cf9be83d472829f6e7903b201e42f6b3c
https://herolab.usd.de/security-advisories/usd-2025-0057
https://nvd.nist.gov/vuln/detail/CVE-2025-65797
5217 https://github.com/usememos/memos/pull/5217
memos.com http://memos.com
usd-2025-0057 https://herolab.usd.de/security-advisories/usd-2025-0057/
usememos.com http://usememos.com
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at http://memos.com
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-12-08T19:46:07Z/ Found at http://memos.com
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/advisories/GHSA-99m2-qwx6-2w6f
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/usememos/memos
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/usememos/memos/commit/769dcd0cf9be83d472829f6e7903b201e42f6b3c
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/usememos/memos/pull/5217
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-12-08T19:46:07Z/ Found at https://github.com/usememos/memos/pull/5217
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://herolab.usd.de/security-advisories/usd-2025-0057
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://herolab.usd.de/security-advisories/usd-2025-0057/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-12-08T19:46:07Z/ Found at https://herolab.usd.de/security-advisories/usd-2025-0057/
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2025-65797
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at http://usememos.com
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-12-08T19:46:07Z/ Found at http://usememos.com
Exploit Prediction Scoring System (EPSS)
Percentile 0.31828
EPSS Score 0.00129
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:57:37.411932+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2025/65xxx/CVE-2025-65797.json 38.6.0