CVE-2026-51583

Published: Aug 11, 2026Modified: Aug 31, 2026Deferred

8.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Exploitability: 3.1 / Impact: 4.7

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

An issue in usememos through v0.30.0 allows a remote authenticated attacker to perform Server-Side Request Forgery (SSRF) via the Webhook validation mechanism in internal/webhook/validate.go, by setting a webhook target to an internal address.

Related CWEs

CWE-918

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (3)

https://gist.github.com/seiyaibuki0523/d8af15eb555808319a2633269a9ebb80

Source: cve@mitre.org

https://github.com/usememos/memos

Source: cve@mitre.org

https://gist.github.com/seiyaibuki0523/d8af15eb555808319a2633269a9ebb80

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.