CVE-2026-6634 Details
Description
A weakness has been identified in usememos memos up to 0.22.1. This affects the function memos_access_token of the file src/App.tsx of the component UpdateInstanceSetting. This manipulation of the argument additionalStyle/additionalScript causes improper authorization. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability exists in usememos memos versions prior to 0.22.1, specifically in the UpdateInstanceSetting component. The issue arises from the backend gRPC-web endpoint 'UpdateInstanceSetting', which fails to properly validate user permissions. This allows standard 'Member' users to bypass frontend restrictions and inject malicious scripts into global instance settings. The injected scripts are executed for all users, including administrators, leading to session hijacking and unauthorized access to sensitive data, such as the memos_access_token.
It is recommended to implement server-side authorization checks to ensure that only users with the appropriate roles can access the UpdateInstanceSetting endpoint. Additionally, replace innerHTML injections with safer alternatives or use a library like DOMPurify to sanitize inputs before adding them to the DOM.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 20, 2026CISA-ADP
Assessed Apr 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Dave-gilmore-aus/security-advisories/blob/main/usememos-security-advisory | [email protected] | ExploitTechnical Analysis |
| https://vuldb.com/submit/793432 | [email protected] | Technical Description |
| https://vuldb.com/vuln/358268 | [email protected] | AdvisoryExploitPartial Content |
| https://vuldb.com/vuln/358268/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-266 | Incorrect Privilege Assignment | [email protected] |
| CWE-285 | Improper Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| usememos memos | <= 0.22.1 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Apr 20, 2026 | New CVE Received | [email protected] |