https://vulnerability.circl.lu/sightings/feed 2026-08-11T19:05:45.248605+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/08c1bf4d-2fab-400f-a249-e2b1de434c89/export 2026-08-11T19:05:45.274648+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "08c1bf4d-2fab-400f-a249-e2b1de434c89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51583", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/dnjjgpnninjk4", "content": "CVE-2026-51583 - usememos Server-Side Request Forgery\nCVE ID : CVE-2026-51583\n \n Published : Aug. 11, 2026, 2:17 p.m. | 14\u00a0minutes ago\n \n Description : An issue in usememos through v0.30.0 allows a remote authenticated attacker to perform Server-Side Request Forgery (SSRF) via...", "creation_timestamp": "2026-08-11T15:00:12.888945Z"} 2026-08-11T15:00:12.888945+00:00 https://vulnerability.circl.lu/sighting/2a2e8416-038c-4092-885b-149d122a0823/export 2026-08-11T19:05:45.279004+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "2a2e8416-038c-4092-885b-149d122a0823", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51583", "type": "seen", "source": "https://gist.github.com/seiyaibuki0523/d8af15eb555808319a2633269a9ebb80", "content": "# CVE-2026-51583 \u2014 Server-Side Request Forgery in Memos Webhook Dispatcher\n\n> Source-level security advisory. An authenticated user can coerce the Memos\n> backend into issuing HTTP requests to internal / unspecified addresses because\n> the webhook URL validator's reserved-CIDR list does not cover `0.0.0.0/8` and\n> several other non-routable ranges.\n\n## Summary\n\n| Field | Value |\n|---|---|\n| CVE | `CVE-2026-51583` |\n| Vulnerability type | Server-Side Request Forgery (CWE-918) |\n| Vendor / product | usememos / memos |\n| Affected component | `internal/webhook/validate.go` (`reservedCIDRs`), shared by `internal/webhook/webhook.go` |\n| Affected versions | \u2264 v0.30.0 (unpatched as of commit `9a928c28`) |\n| Fixed version | None \u2014 no patch available at time of publication |\n| Attack type | Remote, authenticated |\n| Impact | Bypass protection mechanism; internal service access via SSRF |\n| Discoverer | Casper Chen, Cevanex |\n\n## Severity\n\n- **Severity:** Medium\u2013High (depends on what internal services are reachable from the Memos container/host)\n- **CVSS v3.1 (suggested):** `AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N` \u2192 Base 8.5 *(inferred from code; not yet NVD-assigned)*\n- **Source:** inferred from source-level analysis and reproduction, not NVD\n\nAn authenticated, low-privilege user can create a webhook whose target is an\ninternal or unspecified address. When any memo event fires, the Memos backend\ndispatches an HTTP POST to that target from inside the trust boundary,\nreaching services that are not otherwise exposed (cloud metadata endpoints,\ninternal admin panels, other containers on the same network, etc.). The scope\nchange (S:C) reflects that the request originates from the server's network\nposition rather than the attacker's.\n\n## Root Cause\n\nWebhook target URLs are validated at registration time by `ValidateURL()` and\nagain at dispatch time by `safeDialContext()` (`internal/webhook/webhook.go`).\nBoth paths share a single `isReservedIP()` check backed by the `reservedCIDRs`\nlist in `internal/webhook/validate.go`.\n\nThat list is incomplete. It omits, among others:\n\n- `0.0.0.0/8` (unspecified \u2014 resolves to loopback on most stacks)\n- `::` (IPv6 unspecified)\n- `100.64.0.0/10` (CGNAT / shared address space)\n- `192.0.0.0/24` (IETF protocol assignments)\n- `198.18.0.0/15` (benchmarking)\n- multicast ranges\n\nBecause registration-time and dial-time validation reuse the same predicate,\na gap in the list bypasses **both** layers simultaneously. Reproduction against\nthe current tree confirms the gap:\n\n```\n0.0.0.0 blocked=false lookup=[0.0.0.0]\n:: blocked=false\n100.64.0.1 blocked=false (CGNAT)\n192.0.0.1 blocked=false\n127.0.0.1 blocked=true\n```\n\n`127.0.0.1` is correctly blocked, but `0.0.0.0` \u2014 which most network stacks\nroute to loopback for outbound connections \u2014 sails through. The repository\ncurrently makes zero use of `net.IP.IsUnspecified`.\n\nThe bypassed control was introduced by\n[`150371d2`](https://github.com/usememos/memos/commit/150371d2111dfedd21483a21c49183079604d322)\n(`fix(webhook): remediate SSRF vulnerability in webhook dispatcher`,\n2026-02-23, shipped in v0.26.2 / v0.27.0; the file was later relocated from\n`plugin/webhook/validate.go` to `internal/webhook/validate.go` by `10a955fd`\nin v0.27.0). That commit added `reservedCIDRs` but left the ranges above\nuncovered, so the SSRF protection can still be bypassed.\n\n## Proof of Concept\n\n**Step 1 \u2014 start an internal listener inside the Memos container**\n\nSimulate an internally-bound service on port 9999.\n\n**Step 2 \u2014 register a malicious webhook**\n\nAs an authenticated user (e.g. User ID 2) with a valid access token, point the\nwebhook at the unspecified address:\n\n```bash\ncurl -X POST \"http://:5230/api/v1/users/2/webhooks\" \\\n -H \"Authorization: Bearer \" \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"displayName\": \"SSRF-Test\",\n \"url\": \"http://0.0.0.0:9999\"\n }'\n```\n\n**Step 3 \u2014 trigger dispatch**\n\nLog into the Memos web UI, create and publish a memo. This fires the webhook\nevent dispatcher.\n\n**Step 4 \u2014 verify**\n\nThe listener from Step 1 receives an HTTP POST from the Memos backend,\nconfirming the backend was coerced into contacting an internal address that\n`reservedCIDRs` failed to block.\n\n## Remediation\n\nNo upstream patch exists as of v0.30.0. Recommended fix:\n\nReplace or extend the `reservedCIDRs` check with a comprehensive predicate:\n\n```go\nip.IsUnspecified() || ip.IsLoopback() || ip.IsPrivate() || ip.IsLinkLocalUnicast()\n```\n\nand additionally block `100.64.0.0/10`, `192.0.0.0/24`, `198.18.0.0/15`, and\nmulticast. Because `ValidateURL()` and `safeDialContext()` share\n`isReservedIP()`, fixing the predicate closes both the registration-time and\ndispatch-time paths at once. Re-resolve DNS at dial time (or pin the resolved\nIP) to prevent DNS-rebinding from reintroducing the bypass.\n\n## Timeline\n\n- 2026-02-23 \u2014 `150371d2` introduces `reservedCIDRs` (incomplete range list)\n- 2026-04-18 \u2014 Privately reported to the vendor at `dev@usememos.com`, the channel designated in the project's `SECURITY.md`, with a working proof of concept\n- 2026-04-18 \u2013 2026-08-11 \u2014 No vendor response received (115 days)\n- 2026-07-23 \u2014 CVE-2026-51583 reserved by MITRE\n- 2026-08-11 \u2014 Publicly disclosed after exceeding the 90-day coordinated-disclosure window; unpatched as of commit `9a928c28`\n\n## References\n\n- https://github.com/usememos/memos\n- https://github.com/usememos/memos/commit/150371d2111dfedd21483a21c49183079604d322\n- https://github.com/usememos/memos/blob/main/internal/webhook/validate.go", "creation_timestamp": "2026-08-11T04:54:29.094470Z"} 2026-08-11T04:54:29.094470+00:00