A weakness in usememos memos through version 0.22.1 allows an attacker to influence the memos_access_token function by supplying specially crafted values for additionalStyle and additionalScript, thereby bypassing the normal authorization checks. This flaw is categorized as Broken Authentication (CWE‑266) and Improper Authorization (CWE‑285). If exploited, unauthorized users could gain access to protected memos, read or modify content that should be restricted, or perform other privileged actions within the application.

The vulnerability impacts the usememos memos application up to and including release 0.22.1. All installations of these versions are susceptible if the vulnerable UpdateInstanceSetting component is accessible.

The CVSS score of 5.3 indicates medium severity. The vulnerability can be exploited remotely and an exploit has been publicly released, suggesting that it may be actively used. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog, so the current likelihood of exploitation is uncertain. Nevertheless, because the attack vector is remote and the exploit is available, administrators should treat the risk as moderate with potential for significant impact if the flaw is not remediated.