CVE-2025-65797 describes an access control weakness in the Identity Provider service component of usememos memos version 0.25.2. Attackers possessing low-level privileges can exploit this flaw to arbitrarily modify or delete identity providers registered in the system. Such unauthorized changes can result in account takeover scenarios or cause Denial of Service conditions by disrupting identity provider configurations. The vulnerability is categorized under CWE-284 (Improper Access Control) and has a CVSS 3.1 base score of 6.5, indicating a medium severity level. There is no information about available patches or vendor advisories, and no known exploits have been reported in the wild.

Attackers with low-level privileges can manipulate identity provider registrations, potentially leading to account takeover or denial of service. The vulnerability does not directly impact confidentiality or integrity according to the CVSS vector but causes availability disruption (DoS).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Identity Provider service to trusted users only and monitor for unauthorized changes to identity provider configurations.