Medium 4.3Published Oct 11, 2026

CVE-2026-108727EdgeEver through 1.108.0 Missing Authorization via Memo-Template API Routes

Updated under an hour ago (Oct 28, 2026, 11:10 AM ET)

Does this affect you?

It affects tianma-if EdgeEver. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for tianma-if EdgeEver

Exploited in the last 30 days

EdgeEver through 1.108.0 contains a missing authorization vulnerability in the Hono API memo-template routes that allows holders of scoped API tokens to bypass token scope restrictions because template handlers never call requireScopes. Attackers with a token lacking write:memos can save a template and invoke POST /api/v1/templates/:id/use to create memos, and list, modify, or delete templates in the token owner's workspace.

CVSS: 4.3 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness (CWE): CWE-862
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulnCheck
NVD analysis: Deferred
Record last updated: Oct 13, 2026
First seen by InfoSec Signals: Oct 11, 2026

Affected products

Affected products

tianma-if EdgeEver tianma_if:edgeever (from the name)	through 1.108.0	CNA record

References

References

https://hackmd.io/@haind/edgeever-template-write-memos-scope-bypass	third-party-advisory
https://github.com/tianma-if/edgeever/blob/0ef9a1df9c849a64047aba64c70331c2badf8b39/apps/api/src/template-routes.ts#L116-L230	technical-description
https://github.com/tianma-if/edgeever/blob/0ef9a1df9c849a64047aba64c70331c2badf8b39/apps/api/src/memo-routes.ts#L148-L150	technical-description
https://github.com/tianma-if/edgeever	product
https://www.vulncheck.com/advisories/edgeever-through-1.108.0-missing-authorization-via-memo-template-api-routes	third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.