CVE-2025-65798: 
NixOS vulnerability analysis and mitigation

CVE-2025-65798 is an improper access control vulnerability in usememos Memos v0.25.2 that allows authenticated low-privileged users to arbitrarily modify or delete attachments belonging to other users. The vulnerability was published on December 8, 2025, with a patch released shortly after. It affects all Memos installations running version 0.25.2 and earlier (fixed in v0.25.3). The CVSS v3.1 base score is 5.4 (Medium/Moderate) (GitHub Advisory, Feedly).

The root cause is CWE-284 (Improper Access Control) — specifically, the memo_attachment_service.go API endpoint in Memos lacked ownership validation before allowing attachment modification or deletion operations. Any authenticated low-privilege user could send API requests targeting attachments owned by other users, as the service did not verify that the requesting user was the owner of the memo or its attachments. The fix, introduced in GitHub PR #5217, added explicit owner checks to SetMemoAttachments, SetMemoRelations, and DeleteMemoReaction endpoints, along with nil pointer dereference protections. A proof-of-concept is publicly available via the usd HeroLab security advisory (GitHub PR #5217, usd HeroLab).

Successful exploitation allows a low-privileged authenticated attacker to modify or delete attachments created by any other user on the same Memos instance, resulting in data loss and content integrity compromise. The confidentiality impact is low (limited exposure of attachment metadata), while the integrity impact is more significant due to the ability to tamper with or destroy other users' content. Availability is not directly impacted, but targeted deletion of attachments could cause irreversible data loss for affected users (GitHub Advisory).

A proof-of-concept exploit is publicly available through the usd HeroLab security advisory. There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.026–0.042%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (usd HeroLab, GitHub Advisory).

1. Reconnaissance: Identify a target Memos instance running version 0.25.2 or earlier. Register or obtain a low-privilege user account on the instance.
2. Identify target attachments: Browse or enumerate memos and their associated attachments belonging to other users. Note the attachment or memo identifiers from the API responses.
3. Craft malicious API request: Using a tool such as curl or Burp Suite, send an authenticated API request (with the attacker's session token) to the SetMemoAttachments endpoint, specifying the target memo's ID and the desired modification or deletion action.
4. Bypass authorization: Because the server does not validate attachment ownership, the request is processed without checking whether the authenticated user owns the target memo or attachment.
5. Achieve objective: The attacker successfully modifies or deletes the targeted attachment, causing data loss or content tampering for the victim user (usd HeroLab, GitHub PR #5217).

• Network: Unusual API requests to /api/v1/memos/{id}/attachments (SetMemoAttachments endpoint) from user accounts that do not own the referenced memo IDs; repeated cross-user attachment modification or deletion requests from a single low-privilege account.
• Logs: Server access logs showing authenticated low-privilege users performing PUT/DELETE operations on attachment endpoints for memos they did not create; unexpected attachment deletion events in application logs not correlated with the memo owner's session.
• Application: Sudden disappearance or modification of attachments on memos reported by users who did not make changes; audit trail showing attachment changes attributed to non-owner accounts.

Upgrade usememos Memos to version 0.25.3 or later, which includes the authorization fixes introduced in PR #5217 (merged November 6, 2025). The patch adds ownership validation to SetMemoAttachments, SetMemoRelations, and DeleteMemoReaction endpoints. No configuration-based workaround is available for the unpatched version; restricting user registration or limiting the number of trusted users on the instance can reduce exposure until an upgrade is possible (GitHub Advisory, GitHub PR #5217).

The vulnerability was discovered and reported by researchers at usd HeroLab, who published a dedicated security advisory (USD-2025-0059). The fix was contributed by community member FloDwld via GitHub PR #5217 and reviewed by the Memos maintainer (boojack). No significant broader media coverage or notable social media discussion has been identified beyond the technical advisory and GitHub activity (usd HeroLab, GitHub PR #5217).