Listen to this Post
The vulnerability resides in the /api/v1/user endpoint of usememos memos version 0.25.2. This endpoint handles user registration and management functions. Due to flawed access control implementation, the endpoint fails to verify the authentication state or privileges of the requesting client. Normally, such functionality should be restricted to administrative users or require valid session tokens. However, in this version, the authorization middleware is either missing or incorrectly configured for this specific route. Attackers can exploit this by sending a direct HTTP POST request to the endpoint without any credentials or tokens. The crafted request contains JSON data with fields like username, email, and password. The server processes this request without validating if the requester is permitted to create accounts, leading to the creation of arbitrary user accounts. This bypasses all intended registration controls and allows unauthorized individuals to gain access to the system. The issue is network-exploitable if the memos instance is publicly accessible. It represents a critical design flaw in the authorization layer for API routes, making it a severe security risk for deployments.
Platform: usememos memos
Version: v0.25.2
Vulnerability: Unauthorized account creation
Severity: Critical
Date: 12/08/2025
Prediction: Patch expected 01/2026
What Undercode Say:
Analytics
curl -X POST http://
nmap -p 443 –script http-vuln-cve2025-65795
How Exploit:
Send crafted POST request.
Bypass authentication checks.
Create arbitrary admin/user accounts.
Protection from this CVE
Upgrade software version.
Implement endpoint authorization.
Use network access controls.
Impact:
Unauthorized system access.
Privilege escalation possible.
Data integrity compromised.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
