Description
Memos through 0.30.0 omits the 100.64.0.0/10 carrier-grade NAT address range from SSRF protection in its link-metadata fetcher, allowing unauthenticated attackers to bypass IP validation. Attackers can make the server request internal hosts in that range including cloud metadata services and read page titles and descriptions back.
Published: 2026-08-29
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Server Side Request Forgery exposing internal hosts
Action: Patch ASAP
AI Analysis

Impact

Memos v0.30.0 and earlier omit the 100.64.0.0/10 carrier-grade NAT range from its SSRF mitigation, allowing unauthenticated callers to request internal resources. This is a Server Side Request Forgery (CWE-918) weakness. An attacker can submit a link that causes the server to fetch a page within that private range; the server then returns the page title and description, exposing internal host information and potentially cloud metadata service data.

Affected Systems

Memos versions 0.30.0 and earlier, released by usememos/memos.

Risk and Exploitability

The CVSS score of 6.9 indicates medium severity. This is a Server Side Request Forgery (CWE-918) vulnerability. Exploitation requires sending a crafted link to the link‑metadata endpoint and is feasible over the public interface, so unauthenticated attackers can bypass IP validation and reach internal hosts in the omitted range. No exploit probability data is available and the vulnerability is not listed in CISA KEV. Attackers can read limited information such as page titles and descriptions, which may assist in further attacks, but the direct impact is information disclosure and potential pivot to internal services.

Generated by OpenCVE AI on August 29, 2026 at 17:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Memos to the latest release that includes the missing CGNAT address range in SSRF protection.
  • Re‑enable or install a server‑side SSRF guard that validates URLs against the full set of private IP ranges including 100.64.0.0/10.
  • Configure network perimeter devices or reverse proxies to block outbound requests from the web service to internal IP ranges until the patch lands.

Generated by OpenCVE AI on August 29, 2026 at 17:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 31 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 29 Aug 2026 16:45:00 +0000

Type Values Removed Values Added
Description Memos through 0.30.0 omits the 100.64.0.0/10 carrier-grade NAT address range from SSRF protection in its link-metadata fetcher, allowing unauthenticated attackers to bypass IP validation. Attackers can make the server request internal hosts in that range including cloud metadata services and read page titles and descriptions back.
Title Memos through 0.30.0 SSRF via Omitted CGNAT Address Range
First Time appeared Usememos
Usememos memos
Weaknesses CWE-918
CPEs cpe:2.3:a:usememos:memos:*:*:*:*:*:*:*:*
Vendors & Products Usememos
Usememos memos
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Usememos Memos
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-31T18:13:31.780Z

Reserved: 2026-08-29T14:11:15.036Z

Link: CVE-2026-82476

cve-icon Vulnrichment

Updated: 2026-08-31T18:13:27.139Z

cve-icon NVD

Status : Deferred

Published: 2026-08-29T17:18:00.197

Modified: 2026-09-10T15:53:23.707

Link: CVE-2026-82476

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-29T18:15:03Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)