CVE-2026-108727 Details

A missing authorization vulnerability has been identified in EdgeEver versions through 1.108.0. This vulnerability exists within the Hono API's memo-template routes, where template handlers fail to enforce token scope requirements. As a result, holders of scoped API tokens can bypass restrictions. Specifically, attackers with a token that does not include the 'write:memos' scope can still create memos by first saving a template and then using the template to generate a memo. Additionally, these attackers can manage templates within their workspace, including listing, modifying, or deleting them.

The vulnerability can be addressed by adding the appropriate scope checks to the template routes. This involves importing the 'requireScopes' function and applying it to the template creation, usage, update, and deletion handlers. Additionally, the template listing route should require the 'read:memos' scope. Implementing these changes will ensure that the template routes mirror the intended authorization requirements and prevent unauthorized memo creation.