The flaw lies in Memos’ webhook URL validation where the isReservedIP() function checks inbound IPs against a reservedCIDRs list that incorrectly excludes the 0.0.0.0/8 block and does not invoke ip.IsUnspecified. An attacker can register a webhook URL such as http://0.0.0.0:PORT/ to bypass the reserved‑IP check; because many operating systems redirect 0.0.0.0 connections to 127.0.0.1, the Memos server will then perform outbound HTTP requests to its own loopback interface, enabling disclosure of internal-only services that would otherwise be inaccessible from the exterior. This classic Server‑Side Request Forgery (CWE‑918) facilitates internal resource exposure without requiring privileged credentials on the host.

The vulnerability impacts the Memos application as distributed by usememos. All current releases of Memos remain potentially affected until a fix is released, as no specific version information is provided.

With a CVSS score of 8.5, the vulnerability is classified as high severity. The EPSS score is reported as less than 1% and the issue is not listed in CISA’s KEV catalog. The attack vector is inferred from the description: an attacker must be able to register a webhook on the Memos instance. Once registered, the server will automatically make HTTP requests to its loopback address, exposing internal services. The exploit conditions are minimal and do not require elevated host privileges, rendering it a realistic threat.