The vulnerability is a missing authorization check in Memos ActivityService ListActivities and GetActivity methods. Authenticated users can retrieve all users' activity logs, including private memo references, timestamps and creator IDs, leading to confidentiality compromise by exposing user activity and private data to low‑privileged accounts.

The affected product is usememos Memos, version 0.26.2 and all releases prior to 0.27.0. The issue is present in every release before the v0.27.0 update.

The CVSS score of 5.3 indicates medium severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower exploitation likelihood. Authenticated attackers can enumerate sequential activity IDs to harvest sensitive metadata. The attack vector is authenticated user access; no remote code execution or elevated privileges are required.