CVE-2026-113601 [MEDIUM] – Memos before 0.27.0 contains a missing authorization vulnerability in the ActivityService

Memos before 0.27.0 contains a missing authorization vulnerability in the ActivityService ListActivities and GetActivity API methods that allows authenticated users to view all users’ activity records. Low-privileged attackers can enumerate sequential activity IDs to obtain creator IDs, timestamps, and memo-comment references, including activity on other users’ private memos.