Security readout for executives and security teams
Plain-English summary
CVE-2025-65797 is an access-control flaw in usememos memos v0.25.2. A logged-in low-privilege user may be able to change or delete registered identity providers. That can disrupt authentication and may enable account takeover depending on how identity providers are configured.
Executive priority
Treat this as a moderate-priority authentication governance issue. It is not listed as known exploited in the provided sources, but environments using SSO or identity providers should validate quickly because authentication disruption can affect business access.
Technical view
The issue is classified as CWE-284, incorrect access control, in the Identity Provider service. The CVSS 3.1 score is 6.5 with network access, low attack complexity, low privileges, no user interaction, and high availability impact. Source metadata does not provide CPEs or complete affected-product records.
Likely exposure
Organizations running usememos memos v0.25.2 with identity providers configured are the likely exposed group. Exposure is higher where untrusted or broadly provisioned low-privilege accounts exist.
Exploitation context
The source bundle does not show CISA KEV listing or active exploitation. It states the attack requires low-level privileges and can modify or delete identity providers, leading to account takeover or denial of service.
Researcher notes
There is a source inconsistency: the CVE description names usememos memos v0.25.2, while the affected-product fields are listed as n/a. The CVSS vector emphasizes availability impact, while the description also claims account takeover risk. Validate against upstream code and advisory details before broad scoping.
Mitigation direction
- Review the Herolab advisory and upstream pull request for vendor-confirmed fix guidance.
- Upgrade memos if the vendor identifies a fixed release for this issue.
- Restrict identity-provider administration to trusted administrative roles only.
- Audit existing identity-provider entries for unauthorized modification or deletion.
- Limit creation of low-privilege accounts until remediation is confirmed.
Validation and detection
- Inventory memos deployments and confirm whether v0.25.2 is running.
- Check whether external identity providers are configured in each deployment.
- Review application logs for recent identity-provider changes by non-admin users.
- Confirm role enforcement around identity-provider create, update, and delete actions.
- Track vendor advisory updates because affected-version metadata is incomplete.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-65797 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H2.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/usememos/memos/pull/5217CVE reference, mitre
- https://herolab.usd.de/security-advisories/usd-2025-0057/CVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.