CVE-2025-65795
📋 TL;DR
This vulnerability allows unauthenticated attackers to create arbitrary user accounts in usememos memos v0.25.2 by exploiting incorrect access control in the /api/v1/user endpoint. Any organization running the vulnerable version of usememos memos is affected. This could lead to unauthorized access and potential privilege escalation.
💻 Affected Systems
- usememos memos
📦 What is this software?
Memos by Usememos
⚠️ Risk & Real-World Impact
Worst Case
Attackers create administrative accounts, gain full control over the memos instance, access sensitive data, and potentially pivot to other systems.
Likely Case
Attackers create regular user accounts to access shared memos, potentially viewing confidential information or disrupting operations.
If Mitigated
With proper network segmentation and monitoring, impact is limited to the memos application with no lateral movement.
🎯 Exploit Status
Exploitation requires crafting a POST request to the vulnerable endpoint; no authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v0.25.3 or later
Vendor Advisory: https://github.com/usememos/memos/pull/5217
Restart Required: Yes
Instructions:
1. Backup your memos data. 2. Stop the memos service. 3. Update to v0.25.3 or later using your package manager or from GitHub releases. 4. Restart the service.
🔧 Temporary Workarounds
Network Access Control
allRestrict access to the /api/v1/user endpoint using a web application firewall or reverse proxy rules.
# Example nginx location block to block the endpoint
location /api/v1/user { deny all; }
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the memos instance from untrusted networks.
- Enable detailed logging for all requests to /api/v1/user and monitor for suspicious account creation attempts.
🔍 How to Verify
Check if Vulnerable:
Check if your memos version is exactly v0.25.2 by inspecting the application version in the UI or configuration files.Check Version:
Check the application version in the web interface or run: docker inspect usememos/memos | grep versionVerify Fix Applied:
After updating, attempt to create a user via the /api/v1/user endpoint without authentication; it should fail with an access denied error.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /api/v1/user from untrusted IPs
- Multiple user account creation attempts in a short timeframe
Network Indicators:
- HTTP 200 responses to POST /api/v1/user without prior authentication
SIEM Query:
source="memos.log" AND "POST /api/v1/user" AND response_code=200