CVE-2026-108727: Missing Authorization in tianma-if EdgeEver
Description
EdgeEver through 1.108.0 contains a missing authorization vulnerability in the Hono API memo-template routes that allows holders of scoped API tokens to bypass token scope restrictions because template handlers never call requireScopes. Attackers with a token lacking write:memos can save a template and invoke POST /api/v1/templates/:id/use to create memos, and list, modify, or delete templates in the token owner's workspace.
CVSS v4.0
Score 5.3medium
Affected software
tianma-if
EdgeEver
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-108727 describes a missing authorization vulnerability in EdgeEver through version 1.108.0. The issue lies in the Hono API memo-template routes where template handlers do not invoke requireScopes, enabling holders of scoped API tokens to bypass intended scope restrictions. Attackers possessing tokens without write:memos permission can save templates and invoke POST /api/v1/templates/:id/use to create memos. They can also list, modify, or delete templates in the workspace associated with the token owner.
Potential Impact
The vulnerability allows attackers with limited scoped API tokens to perform unauthorized actions such as creating memos and modifying or deleting templates in the token owner's workspace. This could lead to unauthorized data manipulation within the affected user's environment. However, the CVSS score of 5.3 (medium severity) and the lack of known exploits in the wild suggest moderate risk.
Mitigation Recommendations
No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict API token issuance to trusted users and monitor for unusual activity related to memo-template API usage.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-11T01:52:34.282Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6acb85c02cdf04f656d09a18
Added to database: 10/11/2026, 12:49:04 UTC
Last enriched: 10/11/2026, 13:18:33 UTC
Last updated: 10/11/2026, 21:33:18 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.