CVE-2022-4812

Authorization Bypass Through User-Controlled Key in usememos/memos

8.6 HighFix available

Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: High
Availability: Low

Exploit likelihood

0.62%Down 0.3 points since Dec 29, 2022

What each source reports

CVE List Score used 8.6

Authorization Bypass Through User-Controlled Key in usememos/memos

Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.

Record: CVE-2022-4812
CVSS 3.0: 8.6 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Weakness: CWE-639
Updated: 2026-11-02

EUVDEUVD-2022-7677 8.6

Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.

Record: EUVD-2022-7677
CVSS 3.0: 8.6 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Updated: 2026-11-02

GitHub AdvisoriesGHSA-m5pr-wm6q-x4g2 6.5

usememos/memos vulnerable to Comparison of Object References Instead of Object Contents

Comparison of Object References Instead of Object Contents in GitHub repository usememos/memos 0.9.0 and prior.

Record: GHSA-m5pr-wm6q-x4g2
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-595, CWE-639
Updated: 2026-11-02

NVD 6.5

Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.

Record: CVE-2022-4812
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS 3.0: 8.6 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Weakness: CWE-639
Updated: 2026-11-02

OSV 8.6

Authorization Bypass Through User-Controlled Key in usememos/memos

Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.

Record: CVE-2022-4812
CVSS 3.0: 8.6 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Weakness: CWE-639
Updated: 2026-11-02

OSVGHSA-m5pr-wm6q-x4g2 6.5

usememos/memos vulnerable to Comparison of Object References Instead of Object Contents

Comparison of Object References Instead of Object Contents in GitHub repository usememos/memos 0.9.0 and prior.

Record: GHSA-m5pr-wm6q-x4g2
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-595, CWE-639
Updated: 2026-11-02

OSVGO-2022-1260 No score

usememos/memos vulnerable to Comparison of Object References Instead of Object Contents in github.com/usememos/memos

usememos/memos vulnerable to Comparison of Object References Instead of Object Contents in github.com/usememos/memos

Record: GO-2022-1260
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`github.com/usememos/memos` Go	through 0.9.0	0.9.1
`github.com/usememos/memos` Go	before 0.9.1	0.9.1

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-4812 is a high vulnerability (CVSS 8.6) in Usememos Memos, published December 28, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.62%, the 49th percentile. Fixed in github.com/usememos/memos 0.9.1.