{"id":"CVE-2022-4689","aliases":["EUVD-2022-7755","GHSA-w57v-6xp4-rm2v","GO-2022-1191"],"status":"published","title":"Improper Access Control in usememos/memos","description":"Improper Access Control in GitHub repository usememos/memos prior to 0.9.0.","severity":{"version":"3.0","score":8.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00791,"percentile":0.56629,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284"],"published":"2022-12-23T00:00:00Z","modified":"2026-10-28T02:30:54Z","fixes":[{"ecosystem":"Go","package":"github.com/usememos/memos","fixed_in":["0.9.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/usememos/memos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/usememos/memos","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.9.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/usememos/memos","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.9.0"}]}]}],"products":[{"vendor":"usememos","product":"memos"},{"vendor":"usememos","product":"usememos/memos"}],"references":[{"url":"https://github.com/usememos/memos/commit/dca35bde877aab6e64ef51b52e590b5d48f692f9","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://huntr.dev/bounties/a78c4326-6e7b-47fe-aa82-461e5c12a4e3","tags":["x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-4689","tags":["advisory"]},{"url":"https://github.com/usememos/memos/pull/831","tags":["web","fix"]},{"url":"https://github.com/advisories/GHSA-w57v-6xp4-rm2v","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/4xxx/CVE-2022-4689.json","tags":["advisory"]},{"url":"https://github.com/usememos/memos","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-4689","title":"Improper Access Control in usememos/memos","description":"Improper Access Control in GitHub repository usememos/memos prior to 0.9.0.","status":"published","published":"2022-12-23T00:00:00Z","modified":"2025-04-10T18:09:13.166Z","cvss":[{"version":"3.0","score":8.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:34:37.599536Z"}],"euvd":[{"id":"EUVD-2022-7755","description":"Improper Access Control in GitHub repository usememos/memos prior to 0.9.0.","status":"published","published":"2022-12-23T00:00:00Z","modified":"2025-04-10T18:09:13Z","cvss":[{"version":"3.0","score":8.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T20:52:35.819125Z"}],"ghsa":[{"id":"GHSA-w57v-6xp4-rm2v","title":"usememos/memos vulnerable to account takeover due to improper access control","description":"usememos/memos is an open-source, self-hosted memo hub with knowledge management and socialization. Versions prior to 0.9.0 improperly maintain access control allowing an attacker to take over an account by changing header values in the HTTP request.","status":"published","published":"2022-12-23T12:30:25Z","modified":"2023-02-02T05:07:37Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:36:41.247728Z"}],"nvd":[{"id":"CVE-2022-4689","description":"Improper Access Control in GitHub repository usememos/memos prior to 0.9.0.","status":"published","published":"2022-12-23T12:15:12.16Z","modified":"2026-06-17T05:21:34.237Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":8.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:07:34.388163Z"}],"osv":[{"id":"CVE-2022-4689","title":"Improper Access Control in usememos/memos","description":"Improper Access Control in GitHub repository usememos/memos prior to 0.9.0.","status":"published","published":"2022-12-23T00:00:00Z","modified":"2026-10-28T02:30:54.720291236Z","cvss":[{"version":"3.0","score":8.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:44:27.481647Z"},{"id":"GHSA-w57v-6xp4-rm2v","title":"usememos/memos vulnerable to account takeover due to improper access control","description":"usememos/memos is an open-source, self-hosted memo hub with knowledge management and socialization. Versions prior to 0.9.0 improperly maintain access control allowing an attacker to take over an account by changing header values in the HTTP request.","status":"published","published":"2022-12-23T12:30:25Z","modified":"2024-08-21T16:28:43.424603Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:46:58.04805Z"},{"id":"GO-2022-1191","title":"usememos/memos vulnerable to account takeover due to improper access control in github.com/usememos/memos","description":"usememos/memos vulnerable to account takeover due to improper access control in github.com/usememos/memos","status":"published","published":"2024-08-21T16:03:59Z","modified":"2026-03-03T04:52:52.501728Z","updated_at":"2026-11-02T15:47:00.918515Z"}]}}