Vulnerability Description
Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user changes their password, allowing attackers to maintain account access. An attacker with a stolen refresh token can call the RefreshToken RPC to obtain new access tokens and rotate the refresh token indefinitely, bypassing the password change security measure.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/usememos/memos
- https://github.com/usememos/memos/blob/v0.30.0/server/auth/authenticator.go
- https://github.com/usememos/memos/blob/v0.30.0/server/router/api/v1/user_service
- https://www.vulncheck.com/advisories/memos-0.26.0-through-0.30.0-insufficient-se
FAQ
What is CVE-2026-84203?
CVE-2026-84203 is a vulnerability with a CVSS score of 8.1 (HIGH). Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user changes their password, allowing attackers to maintain account access. An attacker with a stolen refresh token can call t...
How severe is CVE-2026-84203?
CVE-2026-84203 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-84203?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.