An authenticated remote attacker can use the webhook validation endpoint in useMemos to issue a ServerSide Request Forgery (SSRF). By setting the webhook target to an internal address, the attacker forces the server to resolve and retrieve the target, exposing internal network endpoints that the attacker could otherwise not reach. The vulnerability represents a classic SSRF flaw, allowing unauthorized internal network communication and potential lateral movement.

Versions of useMemos through v0.30.0 are affected. The issue lies in the internal/webhook/validate.go component and requires a valid user account for exploitation.

The EPSS score is less than 1%, indicating a low probability of public exploitation. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be remote authenticated, requiring valid credentials to access the validation endpoint. Because the flaw permits access to arbitrary internal addresses, the potential impact is high, especially in environments where sensitive internal services are present. The CVSS score of 8.5 reflects high severity.