The vulnerability arises from the isReservedIP function in usememos memos (internal/webhook/validate.go), which validates webhook URLs by checking candidate IPs against a reservedCIDRs list. This list omits the 0.0.0.0/8 range, and the function does not invoke ip.IsUnspecified to detect unspecified IP addresses. In contrast, the sibling function isInternalIP in internal/httpgetter/html_meta.go correctly implements these checks. This discrepancy leads to incomplete validation, potentially allowing reserved or unspecified IP addresses to be accepted where they should be blocked, constituting a CWE-918 (Improper Restriction of Operations within the Bounds of a Memory Buffer) related issue.

An attacker could exploit this validation weakness to bypass IP-based restrictions on webhook URLs, potentially enabling unauthorized internal network access or manipulation of webhook functionality. The CVSS score of 8.5 indicates high impact with network attack vector, low attack complexity, requiring low privileges, no user interaction, and causing high confidentiality impact with limited integrity impact and no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should be cautious about webhook URL configurations and consider additional manual validation or network-level controls to restrict webhook access. Monitor vendor channels for updates and apply patches promptly once released.