CVE-2026-113601: Missing Authorization in usememos memos

CVE-2026-113601 describes a missing authorization vulnerability in the usememos memos application prior to version 0.27.0. Specifically, the ActivityService's ListActivities and GetActivity API methods do not properly restrict access, enabling authenticated users with low privileges to enumerate sequential activity IDs and retrieve activity records belonging to other users. This includes sensitive metadata such as creator identifiers, timestamps, and references to memo comments, even for private memos. The vulnerability has a CVSS 4.0 base score of 5.3, indicating a medium severity level.

Authenticated low-privileged users can access activity records of other users, including private memo activities. This unauthorized disclosure could lead to privacy violations and leakage of user behavior and memo metadata. There is no indication of direct code execution or data modification, but the exposure of private activity information can be significant depending on the sensitivity of the memos.

A fix is available in usememos memos version 0.27.0 and later. Users should upgrade to version 0.27.0 or newer to remediate this missing authorization vulnerability. Until upgraded, restrict access to the affected API methods or limit authenticated user privileges where possible.