The flaw resides in Memos’ webhook URL validation, where the isReservedIP() function omits the 0.0.0.0/8 block and does not detect unspecified IPs. An attacker can register a webhook URL of http://0.0.0.0:PORT/ to bypass the reserved‑IP check. Because Linux redirects 0.0.0.0 connections to 127.0.0.1, the Memos server makes outbound HTTP requests to its own loopback interface, enabling the attacker to reach internal‑only services that would otherwise be unreachable from the external network. This is a classic Server‑Side Request Forgery (CWE‑918) that allows disclosure of sensitive internal resources.

The vulnerability affects the Memos application as distributed by usememos. No specific version information is listed in the CNA data, so all current releases of Memos are potentially impacted until a fix is released.

With a CVSS score of 8.5, the vulnerability is considered high severity. The EPSS score is not disclosed, and the issue is not yet listed in CISA’s KEV catalog. The attack vector is inferred from the description: an attacker must be able to register a webhook on the Memos instance. Once registered, the server will automatically perform HTTP requests to its loopback address, exposing internal services. The exploit does not require any privileged credentials on the host, and the conditions for exploitation are minimal, making it a realistic threat.