What is GHSA-wgqp-f2p3-x7mp?

GHSA-wgqp-f2p3-x7mp is a security advisory published by GitHub Security Advisories with Critical severity. An issue in usememos v0.27.1 allows a remote attacker to achieve account takeover via the...

Which CVE IDs does GHSA-wgqp-f2p3-x7mp cover?

GHSA-wgqp-f2p3-x7mp covers the following CVE IDs: CVE-2026-51584. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-wgqp-f2p3-x7mp?

GHSA-wgqp-f2p3-x7mp has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

GHSA-wgqp-f2p3-x7mpCriticalCVSS 9.8

An issue in usememos v0.27.1 allows a remote attacker to achieve account takeover via the...

Vendor

GitHub Security Advisories

Published

August 11, 2026

Last Modified

August 12, 2026

🔗 CVE IDs covered (1)

CVE-2026-51584 →

📋 Description

An issue in usememos v0.27.1 allows a remote attacker to achieve account takeover via the ssoCredentials branch of the SignIn handler in server/router/api/v1/auth_service.go, because SSO identity is matched only on an attacker-controllable identifier without binding to the IdP's stable subject claim.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-51584
https://gist.github.com/seiyaibuki0523/33a4c06eb7d10914e5e5152ecd5100ec
https://github.com/usememos/memos
https://github.com/advisories/GHSA-wgqp-f2p3-x7mp