CVE-2022-4686 HIGH

CVE-2022-4686: Authorization Bypass Through User-Controlled Key in usememos/memos

Vendor Usememos
Product usememos/memos
Weakness CWE-639 · IDOR
Published December 23, 2022
Last update April 9, 2025
View on NVD All CVEs

CVSS base score

8.6/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity Low

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

What the vulnerability does

01Description

Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.0.

Key dates

02Disclosure timeline

December 23, 2022 CVE published
April 9, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-29181 @strapi/plugin-content-manager leaks data via relations via the Admin Panel CVE-2026-1219 MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar 4.0 - 5.10 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure CVE-2025-5681 IDOR in Turtek Software's Eyotek CVE-2024-10215 WPBookit <= 1.6.4 - Unauthenticated Arbitrary User Password Change CVE-2026-3473 Improper file ownership validation in the Boards API allows unauthorised file access