CVE-2026-84203

EUVD-2026-69290
Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user changes their password, allowing attackers to maintain account access. An attacker with a stolen refresh token can call the RefreshToken RPC to obtain new access tokens and rotate the refresh token indefinitely, bypassing the password change security measure.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
8.1 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
usememosmemos
0.26.0 ≤
𝑥
≤ 0.30.0
CNA
Common Weakness Enumeration
References
https://github.com/usememos/memos
https://github.com/usememos/memos/blob/v0.30.0/server/auth/authenticator.go
https://github.com/usememos/memos/blob/v0.30.0/server/router/api/v1/user_service.go
https://www.vulncheck.com/advisories/memos-0.26.0-through-0.30.0-insufficient-session-expiration-on-password-change