CVE-2026-108727: EdgeEver through 1.108.0 Missing Authorization via Memo-Template API Routes
EdgeEver through 1.108.0 contains a missing authorization vulnerability in the Hono API memo-template routes that allows holders of scoped API tokens to bypass token scope restrictions because template handlers never call requireScopes. Attackers with a token lacking write:memos can save a template and invoke POST /api/v1/templates/:id/use to create memos, and list, modify, or delete templates in the token owner's workspace.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a valid scoped API token for a workspace. The token does not need the write:memos scope, but it must be associated with the token owner's workspace.
What actions can an attacker perform with an insufficiently scoped token?
They can create and manage memo templates in the token owner's workspace, including listing, modifying, and deleting templates. They can also save a template and invoke the template-use endpoint to create memos.
Are unauthenticated attackers affected?
No. Exploitation requires a scoped API token; the issue is a bypass of token scope restrictions rather than an unauthenticated access flaw.
How can teams determine whether a token may have been used to bypass memo-write restrictions?
Review activity associated with scoped API tokens that lack write:memos for template creation or management and calls to POST /api/v1/templates/:id/use. Such activity could have resulted in memo creation despite the token lacking the expected memo-write scope.