auth

package

Go to main page

Versions in this module

v0

v0.31.0

Sep 19, 2026 GO-2025-3492 +4 more

GO-2025-3492: Memos Server-Side Request Forgery (SSRF) in github.com/usememos/memos

GO-2025-3936: Memos Vulnerable to Path Traversal via the CreateResource Endpoint in github.com/usememos/memos

GO-2025-3937: Memos Vulnerable to Stored Cross-Site Scripting in github.com/usememos/memos

GO-2025-4127: Memos' Access Tokens Stay Valid after User Password Change in github.com/usememos/memos

GO-2026-5403: Memos has an Incorrect Privilege Assignment issue in github.com/usememos/memos

v0.31.0-rc.2

Sep 15, 2026 GO-2025-3492 +4 more

GO-2025-3492: Memos Server-Side Request Forgery (SSRF) in github.com/usememos/memos

GO-2025-3936: Memos Vulnerable to Path Traversal via the CreateResource Endpoint in github.com/usememos/memos

GO-2025-3937: Memos Vulnerable to Stored Cross-Site Scripting in github.com/usememos/memos

GO-2025-4127: Memos' Access Tokens Stay Valid after User Password Change in github.com/usememos/memos

GO-2026-5403: Memos has an Incorrect Privilege Assignment issue in github.com/usememos/memos

v0.31.0-rc.1

Aug 30, 2026 GO-2025-3492 +4 more

GO-2025-3492: Memos Server-Side Request Forgery (SSRF) in github.com/usememos/memos

GO-2025-3936: Memos Vulnerable to Path Traversal via the CreateResource Endpoint in github.com/usememos/memos

GO-2025-3937: Memos Vulnerable to Stored Cross-Site Scripting in github.com/usememos/memos

GO-2025-4127: Memos' Access Tokens Stay Valid after User Password Change in github.com/usememos/memos

GO-2026-5403: Memos has an Incorrect Privilege Assignment issue in github.com/usememos/memos

v0.30.0

Jul 26, 2026 GO-2025-3492 +4 more

GO-2025-3492: Memos Server-Side Request Forgery (SSRF) in github.com/usememos/memos

GO-2025-3936: Memos Vulnerable to Path Traversal via the CreateResource Endpoint in github.com/usememos/memos

GO-2025-3937: Memos Vulnerable to Stored Cross-Site Scripting in github.com/usememos/memos

GO-2025-4127: Memos' Access Tokens Stay Valid after User Password Change in github.com/usememos/memos

GO-2026-5403: Memos has an Incorrect Privilege Assignment issue in github.com/usememos/memos

v0.30.0-rc.2

Jul 20, 2026 GO-2025-3492 +4 more

GO-2025-3492: Memos Server-Side Request Forgery (SSRF) in github.com/usememos/memos

GO-2025-3936: Memos Vulnerable to Path Traversal via the CreateResource Endpoint in github.com/usememos/memos

GO-2025-3937: Memos Vulnerable to Stored Cross-Site Scripting in github.com/usememos/memos

GO-2025-4127: Memos' Access Tokens Stay Valid after User Password Change in github.com/usememos/memos

GO-2026-5403: Memos has an Incorrect Privilege Assignment issue in github.com/usememos/memos

v0.30.0-rc.1

Jul 14, 2026 GO-2025-3492 +4 more

GO-2025-3492: Memos Server-Side Request Forgery (SSRF) in github.com/usememos/memos

GO-2025-3936: Memos Vulnerable to Path Traversal via the CreateResource Endpoint in github.com/usememos/memos

GO-2025-3937: Memos Vulnerable to Stored Cross-Site Scripting in github.com/usememos/memos

GO-2025-4127: Memos' Access Tokens Stay Valid after User Password Change in github.com/usememos/memos

GO-2026-5403: Memos has an Incorrect Privilege Assignment issue in github.com/usememos/memos

v0.29.1

Jun 5, 2026 GO-2025-3492 +4 more

GO-2025-3492: Memos Server-Side Request Forgery (SSRF) in github.com/usememos/memos

GO-2025-3936: Memos Vulnerable to Path Traversal via the CreateResource Endpoint in github.com/usememos/memos

GO-2025-3937: Memos Vulnerable to Stored Cross-Site Scripting in github.com/usememos/memos

GO-2025-4127: Memos' Access Tokens Stay Valid after User Password Change in github.com/usememos/memos

GO-2026-5403: Memos has an Incorrect Privilege Assignment issue in github.com/usememos/memos

v0.29.0

May 27, 2026 GO-2025-3492 +4 more

GO-2025-3492: Memos Server-Side Request Forgery (SSRF) in github.com/usememos/memos

GO-2025-3936: Memos Vulnerable to Path Traversal via the CreateResource Endpoint in github.com/usememos/memos

GO-2025-3937: Memos Vulnerable to Stored Cross-Site Scripting in github.com/usememos/memos

GO-2025-4127: Memos' Access Tokens Stay Valid after User Password Change in github.com/usememos/memos

GO-2026-5403: Memos has an Incorrect Privilege Assignment issue in github.com/usememos/memos

v0.28.0

Apr 27, 2026 GO-2025-3492 +4 more

GO-2025-3492: Memos Server-Side Request Forgery (SSRF) in github.com/usememos/memos

GO-2025-3936: Memos Vulnerable to Path Traversal via the CreateResource Endpoint in github.com/usememos/memos

GO-2025-3937: Memos Vulnerable to Stored Cross-Site Scripting in github.com/usememos/memos

GO-2025-4127: Memos' Access Tokens Stay Valid after User Password Change in github.com/usememos/memos

GO-2026-5403: Memos has an Incorrect Privilege Assignment issue in github.com/usememos/memos

v0.27.1

Apr 19, 2026 GO-2025-3492 +4 more

GO-2025-3492: Memos Server-Side Request Forgery (SSRF) in github.com/usememos/memos

GO-2025-3936: Memos Vulnerable to Path Traversal via the CreateResource Endpoint in github.com/usememos/memos

GO-2025-3937: Memos Vulnerable to Stored Cross-Site Scripting in github.com/usememos/memos

GO-2025-4127: Memos' Access Tokens Stay Valid after User Password Change in github.com/usememos/memos

GO-2026-5403: Memos has an Incorrect Privilege Assignment issue in github.com/usememos/memos

v0.27.0

Apr 18, 2026 GO-2025-3492 +4 more

GO-2025-3492: Memos Server-Side Request Forgery (SSRF) in github.com/usememos/memos

GO-2025-3936: Memos Vulnerable to Path Traversal via the CreateResource Endpoint in github.com/usememos/memos

GO-2025-3937: Memos Vulnerable to Stored Cross-Site Scripting in github.com/usememos/memos

GO-2025-4127: Memos' Access Tokens Stay Valid after User Password Change in github.com/usememos/memos

GO-2026-5403: Memos has an Incorrect Privilege Assignment issue in github.com/usememos/memos

Changes in this version

+ func ApplyToContext(ctx context.Context, result *AuthResult) context.Context

type Authenticator

+ func (a *Authenticator) AuthenticateToUser(ctx context.Context, authHeader, cookieHeader string) (*store.User, error)

v0.27.0-rc.2

Apr 10, 2026 GO-2025-3492 +4 more

GO-2025-3492: Memos Server-Side Request Forgery (SSRF) in github.com/usememos/memos

GO-2025-3936: Memos Vulnerable to Path Traversal via the CreateResource Endpoint in github.com/usememos/memos

GO-2025-3937: Memos Vulnerable to Stored Cross-Site Scripting in github.com/usememos/memos

GO-2025-4127: Memos' Access Tokens Stay Valid after User Password Change in github.com/usememos/memos

GO-2026-5403: Memos has an Incorrect Privilege Assignment issue in github.com/usememos/memos

v0.27.0-rc.1

Mar 31, 2026 GO-2025-3492 +4 more

GO-2025-3492: Memos Server-Side Request Forgery (SSRF) in github.com/usememos/memos

GO-2025-3936: Memos Vulnerable to Path Traversal via the CreateResource Endpoint in github.com/usememos/memos

GO-2025-3937: Memos Vulnerable to Stored Cross-Site Scripting in github.com/usememos/memos

GO-2025-4127: Memos' Access Tokens Stay Valid after User Password Change in github.com/usememos/memos

GO-2026-5403: Memos has an Incorrect Privilege Assignment issue in github.com/usememos/memos

v0.26.2

Feb 23, 2026 GO-2025-3492 +4 more

GO-2025-3492: Memos Server-Side Request Forgery (SSRF) in github.com/usememos/memos

GO-2025-3936: Memos Vulnerable to Path Traversal via the CreateResource Endpoint in github.com/usememos/memos

GO-2025-3937: Memos Vulnerable to Stored Cross-Site Scripting in github.com/usememos/memos

GO-2025-4127: Memos' Access Tokens Stay Valid after User Password Change in github.com/usememos/memos

GO-2026-5403: Memos has an Incorrect Privilege Assignment issue in github.com/usememos/memos

v0.26.1

Feb 8, 2026 GO-2025-3492 +4 more

GO-2025-3492: Memos Server-Side Request Forgery (SSRF) in github.com/usememos/memos

GO-2025-3936: Memos Vulnerable to Path Traversal via the CreateResource Endpoint in github.com/usememos/memos

GO-2025-3937: Memos Vulnerable to Stored Cross-Site Scripting in github.com/usememos/memos

GO-2025-4127: Memos' Access Tokens Stay Valid after User Password Change in github.com/usememos/memos

GO-2026-5403: Memos has an Incorrect Privilege Assignment issue in github.com/usememos/memos

v0.26.0

Jan 31, 2026 GO-2025-3492 +4 more

GO-2025-3492: Memos Server-Side Request Forgery (SSRF) in github.com/usememos/memos

GO-2025-3936: Memos Vulnerable to Path Traversal via the CreateResource Endpoint in github.com/usememos/memos

GO-2025-3937: Memos Vulnerable to Stored Cross-Site Scripting in github.com/usememos/memos

GO-2025-4127: Memos' Access Tokens Stay Valid after User Password Change in github.com/usememos/memos

GO-2026-5403: Memos has an Incorrect Privilege Assignment issue in github.com/usememos/memos

Changes in this version

+ const AccessTokenDuration

+ const Issuer

+ const KeyID

+ const PersonalAccessTokenPrefix

+ const RefreshTokenDuration

+ func ExtractBearerToken(authHeader string) string

+ func ExtractRefreshTokenFromCookie(cookieHeader string) string

+ func GenerateAccessTokenV2(userID int32, username, role, status string, secret []byte) (string, time.Time, error)

+ func GeneratePersonalAccessToken() string

+ func GetAccessToken(ctx context.Context) string

+ func GetUserID(ctx context.Context) int32

+ func HashPersonalAccessToken(token string) string

+ func SetUserClaimsInContext(ctx context.Context, claims *UserClaims) context.Context

+ func SetUserInContext(ctx context.Context, user *store.User, accessToken string) context.Context

+ type AccessTokenClaims struct

+ Role string

+ Status string

+ Type string

+ Username string

+ func ParseAccessTokenV2(tokenString string, secret []byte) (*AccessTokenClaims, error)

+ type AuthResult struct

+ AccessToken string

+ Claims *UserClaims

+ User *store.User

+ type Authenticator struct

+ func NewAuthenticator(store *store.Store, secret string) *Authenticator

+ func (a *Authenticator) Authenticate(ctx context.Context, authHeader string) *AuthResult

+ func (a *Authenticator) AuthenticateByAccessTokenV2(accessToken string) (*UserClaims, error)

+ func (a *Authenticator) AuthenticateByPAT(ctx context.Context, token string) (*store.User, *storepb.PersonalAccessTokensUserSetting_PersonalAccessToken, ...)

+ func (a *Authenticator) AuthenticateByRefreshToken(ctx context.Context, refreshToken string) (*store.User, string, error)

+ type ClaimsMessage struct

+ Name string

+ type ContextKey int

+ const AccessTokenContextKey

+ const RefreshTokenIDContextKey

+ const UserClaimsContextKey

+ const UserIDContextKey

+ type RefreshTokenClaims struct

+ TokenID string

+ Type string

+ func ParseRefreshToken(tokenString string, secret []byte) (*RefreshTokenClaims, error)

+ type UserClaims struct

+ Role string

+ Status string

+ UserID int32

+ Username string

+ func GetUserClaims(ctx context.Context) *UserClaims

v0.13.2

Jul 1, 2023 GO-2023-2065 +15 more

GO-2023-2065: Cross-Site Request Forgery (CSRF) in usememos/memos in github.com/usememos/memos

GO-2024-3046: memos vulnerable to Server-Side Request Forgery in /api/resource in github.com/usememos/memos

GO-2024-3047: memos vulnerable to Server-Side Request Forgery in /o/get/httpmeta in github.com/usememos/memos

GO-2024-3049: memos vulnerable to Server-Side Request Forgery and Cross-site Scripting in github.com/usememos/memos

GO-2024-3088: memos CORS Misconfiguration in server.go (GHSL-2024-034) in github.com/usememos/memos

GO-2025-3492: Memos Server-Side Request Forgery (SSRF) in github.com/usememos/memos

GO-2025-3831: Memos has Cross-Site Scripting (XSS) Vulnerability in Image URLs in github.com/usememos/memos

GO-2025-3936: Memos Vulnerable to Path Traversal via the CreateResource Endpoint in github.com/usememos/memos

GO-2025-3937: Memos Vulnerable to Stored Cross-Site Scripting in github.com/usememos/memos

GO-2025-4127: Memos' Access Tokens Stay Valid after User Password Change in github.com/usememos/memos

GO-2025-4215: memos vulnerability allows arbitrarily reactions deletion in github.com/usememos/memos

GO-2025-4216: memos vulnerability allows arbitrarily modification or deletion of attachments in github.com/usememos/memos

GO-2025-4217: memos vulnerability allows the creation of arbitrary accounts in github.com/usememos/memos

GO-2025-4218: memos lacks file name validation or verification in github.com/usememos/memos

GO-2025-4220: memos vulnerability allows arbitrarily modification or deletion registered identity providers in github.com/usememos/memos

GO-2026-5403: Memos has an Incorrect Privilege Assignment issue in github.com/usememos/memos

Changes in this version

+ func GenerateTokensAndSetCookies(c echo.Context, user *store.UserMessage, secret string) error

+ func RemoveTokensAndCookies(c echo.Context)

v0.13.1

May 27, 2023 GO-2023-2036 +17 more

GO-2023-2036: usememos/memos vulnerable to privilege escalation in github.com/usememos/memos

GO-2023-2038: Account TakeOver Due to Improper Handling of JWT Tokens in usememos/memos in github.com/usememos/memos