CVE-2026-113601
Memos before 0.27.0 contains a missing authorization vulnerability in the ActivityService ListActivities and GetActivity API methods that al
CVSS
4.3
Medio
EPSS
—
KEV
—
Exploit Today
—
0-100
Publicado: 20 oct 2026 · Última mod.: 20 oct 2026 · CWE-862
Sin historial EPSS suficiente todavía.
Memos before 0.27.0 contains a missing authorization vulnerability in the ActivityService ListActivities and GetActivity API methods that allows authenticated users to view all users' activity records. Low-privileged attackers can enumerate sequential activity IDs to obtain creator IDs, timestamps, and memo-comment references, including activity on other users' private memos.
- github.comhttps://github.com/usememos/memos/blob/v0.26.2/server/router/api/v1/activity_service.go
- github.comhttps://github.com/usememos/memos/commit/04f239a2fc74f7090c779a6a7b8a08238fd31b88
- github.comhttps://github.com/usememos/memos/issues/5651
- github.comhttps://github.com/usememos/memos/releases/tag/v0.27.0
- www.vulncheck.comhttps://www.vulncheck.com/advisories/memos-before-0.27.0-missing-authorization-via-activityservice-listactivities-getactivity
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1140828.1 ALT—
———Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credential directly against the storage API to append, create, or trim other session and run streams, forging output or permanently deleting records.6hCVE-2026-1140713.1 BAJ—
———Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows authenticated project members to complete another member's DEVELOPMENT environment waitpoint by skipping the per-user environment ownership check. Attackers who know a victim's waitpoint friendly ID can submit type=DATETIME or type=MANUAL with isTimeout to prematurely mark the pending waitpoint completed.6hCVE-2026-1140584.3 MED—
———ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that lets authenticated users read other databases' schema metadata. Attackers with credentials for one database can set the db field in RUN or BEGIN messages and call db.labels() or SHOW INDEXES to enumerate unauthorized schemas.6hCVE-2026-1140574.3 MED—
———ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that allows authenticated users to enumerate all database names. Attackers with credentials for any single database can issue a SHOW DATABASES query over the Bolt port to reveal unauthorized database names, exposing tenant or project identifiers.6hCVE-2026-1140564.3 MED—
———ArcadeDB from 26.8.1 before 26.10.1 contains an authorization bypass vulnerability that allows read-only users to modify edge type lightweight and unique schema flags without UPDATE_SCHEMA permission. Attackers can send a bare ALTER TYPE edgeType WITH lightweight = true command over the HTTP, gRPC, or Bolt command API to persistently alter edge storage declarations.6hCVE-2026-113128——
———Missing authorization in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)9h