CVE-2025-65797: Medium severity npm/usememos vulnerability
Incorrect access control in the Identity Provider service of usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify or delete registered identity providers, leading to an account takeover or Denial of Service (DoS).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/usememos/memosto a version that resolves this vulnerability.Fixed in 0.25.3
Event History
Frequently Asked Questions
What is the severity of CVE-2025-65797?
CVE-2025-65797 is considered critical due to the potential for account takeover and Denial of Service.
How do I fix CVE-2025-65797?
To fix CVE-2025-65797, upgrade to version 0.25.3 or later of usememos.
What type of vulnerability is CVE-2025-65797?
CVE-2025-65797 is an incorrect access control vulnerability in the Identity Provider service.
Who is affected by CVE-2025-65797?
Users of the usememos application version 0.25.2 are affected by CVE-2025-65797.
What can attackers do with CVE-2025-65797?
Attackers with low-level privileges can arbitrarily modify or delete registered identity providers.