CVE-2025-65797 Overview
CVE-2025-65797 is an incorrect access control vulnerability in the Identity Provider service of usememos memos version 0.25.2. The flaw allows authenticated users with low-level privileges to arbitrarily modify or delete registered identity providers. Successful exploitation leads to account takeover or Denial of Service (DoS) by removing legitimate authentication paths. The underlying weakness is categorized as [CWE-284] Improper Access Control.
Critical Impact
Low-privileged attackers can tamper with identity provider configurations, enabling account takeover of other users or disruption of authentication for the entire Memos instance.
Affected Products
- usememos memos v0.25.2
Discovery Timeline
- 2025-12-08 - CVE CVE-2025-65797 published to NVD
- 2026-10-15 - Last updated in NVD database
Technical Details for CVE-2025-65797
Vulnerability Analysis
Memos is an open-source, self-hosted note-taking service that supports external authentication through configurable identity providers (IdPs) such as OAuth2 and OIDC. The Identity Provider service exposes administrative endpoints that modify or delete these IdP configurations.
In version 0.25.2, these endpoints do not enforce administrator-level authorization. Any authenticated user, including the lowest privilege tier, can invoke them. This breaks the trust boundary between normal users and workspace administrators.
Root Cause
The service relies on authentication but omits a role or permission check before executing mutating operations on identity provider records. Request handlers for updating and deleting IdPs process the request based on session validity alone, without verifying the caller holds an administrator role.
Attack Vector
An attacker with a standard Memos account sends crafted API requests to the identity provider management endpoints over the network. The attacker can replace redirect URIs, client secrets, or endpoint URLs of an existing provider to intercept authentication flows and hijack sessions of other users logging in through that IdP. Alternatively, deleting all registered providers removes the ability of federated users to authenticate, producing a denial of service. Refer to the USD Security Advisory 2025-0057 for the technical write-up.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2025-65797
Indicators of Compromise
- Unexpected changes to identity provider records, such as modified client_id, client_secret, or redirect URLs within the Memos database or configuration store.
- Deletion of previously registered identity providers without a corresponding administrator action in audit logs.
- Authentication failures reported by federated users immediately following suspicious API activity.
Detection Strategies
- Review HTTP access logs for requests to identity provider management API paths originating from non-administrator accounts.
- Correlate IdP configuration changes with the role of the authenticated principal at the time of the request.
- Alert on OAuth or OIDC callback traffic redirecting to domains that do not match the organization's approved identity providers.
Monitoring Recommendations
- Enable application-level audit logging for all create, update, and delete operations against identity providers.
- Forward Memos application and web server logs to a central SIEM for retention and correlation with authentication events.
- Baseline the expected set of registered identity providers and alert on any drift.
How to Mitigate CVE-2025-65797
Immediate Actions Required
- Upgrade Memos to a version containing the fix tracked in usememos/memos pull request 5217.
- Rotate any OAuth or OIDC client secrets configured in Memos, since they may have been exposed or modified.
- Audit the current list of registered identity providers and restore any that were deleted or tampered with.
Patch Information
The maintainers addressed the issue in the upstream repository through usememos/memos PR #5217, which adds the missing access control checks to the Identity Provider service endpoints. Operators running v0.25.2 should update to a release that incorporates this change.
Workarounds
- Restrict network access to the Memos instance so that only trusted users can reach the API, reducing the pool of accounts able to abuse the endpoints.
- Place Memos behind a reverse proxy that enforces an additional authorization layer on identity provider management paths until the patched version is deployed.
- Temporarily disable self-registration to limit the creation of low-privilege accounts that could exploit the flaw.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
