Able to assign HOST role to new User in usememos/memos


Reported on

Dec 27th 2022


As per the functionality we only can add user role as a "USER" in account Due to the no server side valaditon on "role" parameter , we can add new member as a "HOST" role with all HOST users privilege

Proof of Concept

  1. while adding new user intercept the request in burp
  2. change the POST body role paramater value as "HOST"
  3. the newaly added user have HOST users privilege


refer ss/Video POC :


Due to the issue , we can assign role as HOST to user . without having functionality.

after new role we can Delete old HOST role Account . example: demohero alt text

We are processing your report and will contact the usememos/memos team within 24 hours. a year ago
A GitHub Issue asking the maintainers to create a exists a year ago
Anil Bhatt modified the report
a year ago
STEVEN validated this vulnerability a year ago
Anil Bhatt has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
STEVEN marked this as fixed in 0.9.1 with commit 3556ae a year ago
STEVEN has been awarded the fix bounty
This vulnerability has been assigned a CVE
STEVEN published this vulnerability a year ago
to join this conversation