CVE-2026-30586 is a Cross Site Scripting (CWE-79) vulnerability affecting usememos Memos version 0.26.0. The flaw allows remote attackers to leverage weaknesses in the SANITIZE_SCHEMA, Memo Rendering Component, and Public/Private Memo View pages to access sensitive information. The vulnerability has a CVSS 3.1 base score of 6.1 (medium severity) with an attack vector of network, low attack complexity, no privileges required, user interaction required, scope changed, and impacts confidentiality and integrity. There is no vendor advisory or patch available at this time.

Successful exploitation of this vulnerability could allow a remote attacker to execute malicious scripts in the context of the affected application, leading to unauthorized disclosure of sensitive information and potential integrity impacts. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with untrusted content in the affected version 0.26.0 of usememos Memos. No official mitigation or workaround has been provided.