CVE-2026-82476: Server-Side Request Forgery (SSRF) in usememos memos

The SSRF vulnerability in usememos memos up to version 0.30.0 arises because the link-metadata fetcher does not block requests to the 100.64.0.0/10 carrier-grade NAT address range. This omission allows unauthenticated attackers to bypass IP validation controls and induce the server to make HTTP requests to internal network addresses within this range. As a result, attackers can access internal resources such as cloud metadata services and retrieve information like page titles and descriptions.

An unauthenticated attacker can exploit this SSRF vulnerability to make the server send requests to internal IP addresses within the 100.64.0.0/10 range, potentially accessing sensitive internal services such as cloud metadata endpoints. This can lead to information disclosure of internal network resources. The CVSS score of 6.9 (medium severity) reflects the network attack vector with no privileges or user interaction required, but with limited impact confined to information disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting network access from the memos server to internal IP ranges or apply custom filtering to block requests to the 100.64.0.0/10 range in the link-metadata fetcher if possible.