CVE-2026-51583

Description

An issue in usememos through v0.30.0 allows a remote authenticated attacker to perform Server-Side Request Forgery (SSRF) via the Webhook validation mechanism in internal/webhook/validate.go, by setting a webhook target to an internal address.

References

• https://gist.github.com/seiyaibuki0523/d8af15eb555808319a2633269a9ebb80
• https://github.com/usememos/memos