CVE-2025-65797: 
NixOS vulnerability analysis and mitigation

CVE-2025-65797 is an improper access control vulnerability in the Identity Provider (IDP) service of usememos/memos v0.25.2 that allows low-privileged authenticated attackers to arbitrarily modify or delete registered identity providers, potentially leading to account takeover or Denial of Service (DoS). The vulnerability was published on December 8, 2025, and a patch was merged on November 6, 2025 via GitHub PR #5217. It carries a CVSS v3.1 base score of 6.5 (Medium) (Feedly, GitHub PR).

The root cause is CWE-284 (Improper Access Control): the IDP service endpoints for updating and deleting identity providers lacked authorization checks, allowing any authenticated low-privileged user to perform operations that should be restricted to host/admin users. Additionally, the client secret for identity providers was disclosed to non-host users, creating an information disclosure risk. The fix added explicit authentication and role checks to the idp_service.go handler, restricting delete and update operations to host users only and redacting client secrets from responses for non-host users (GitHub PR).

A low-privileged authenticated attacker can modify or delete any registered identity provider configuration, which could redirect authentication flows to an attacker-controlled provider, enabling account takeover of other users. Alternatively, deleting all identity providers could deny SSO-dependent users the ability to authenticate, resulting in a Denial of Service. The exposure of client secrets to non-host users further risks OAuth credential theft and unauthorized third-party access (Feedly, GitHub PR).

A security advisory from usd HeroLab (usd-2025-0057) documents the vulnerability and serves as a public reference, indicating researcher-confirmed exploitability. The EPSS score is approximately 0.038%, suggesting low but non-zero probability of near-term exploitation. There is no evidence of active in-the-wild exploitation or CISA KEV catalog listing at this time (Feedly, usd HeroLab).

1. Authenticate as a low-privileged user: Obtain valid credentials for any standard (non-host) account on the target memos instance running v0.25.2.
2. Enumerate identity providers: Send an authenticated API request to the IDP listing endpoint to discover registered identity providers and their IDs (e.g., GET /api/v1/identityProviders).
3. Modify or delete an IDP: Issue an authenticated PATCH or DELETE request to the IDP endpoint (e.g., DELETE /api/v1/identityProviders/{id}) using the low-privileged session token — the missing authorization check allows this to succeed.
4. Achieve account takeover or DoS: By modifying an IDP to point to an attacker-controlled OAuth server, subsequent SSO logins by other users can be intercepted. Alternatively, deleting all IDPs disrupts authentication for SSO-dependent users, causing a DoS (GitHub PR, usd HeroLab).

• Network: Unexpected PATCH or DELETE API requests to IDP endpoints (e.g., /api/v1/identityProviders/{id}) originating from non-admin user sessions.
• Logs: Application logs showing IDP modification or deletion events attributed to low-privileged user accounts; repeated API calls to IDP endpoints from the same low-privileged user.
• Application State: Sudden disappearance or modification of registered identity providers in the admin panel; SSO login failures following IDP deletion; OAuth redirect URIs changed to unknown external domains.

The fix is included in commits merged to the main branch of usememos/memos on November 6, 2025 (PR #5217 and follow-up PR #5228). Users should upgrade to any release built from the patched main branch after November 6, 2025. No configuration-based workaround is available; upgrading is the only remediation. As an interim measure, administrators can restrict access to the memos instance to trusted users only and monitor IDP configuration for unauthorized changes (GitHub PR).

The vulnerability was discovered and reported by researchers at usd HeroLab, who published a dedicated security advisory (usd-2025-0057). The fix was contributed by community member FloDwld via a pull request that also addressed several related authorization issues across multiple services. No significant broader media coverage or notable social media discussion has been identified beyond standard CVE tracking and aggregator sites.