CVE-2026-84203CWE-613

CVE-2026-84203

High · published September 1, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
37.9
In the wild
Unconfirmed
What it is

Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user changes their password, allowing attackers to maintain account access. An attacker with a stolen refresh token can call the RefreshToken RPC to obtain new access tokens and rotate the refresh token indefinitely, bypassing the password change security measure.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
8.6 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00448 · 37.9th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2026-09-01T20:17Z
References (4)
https://github.com/usememos/memos · [email protected]https://github.com/usememos/memos/blob/v0.30.0/server/auth/authenticator.go · [email protected]https://github.com/usememos/memos/blob/v0.30.0/server/router/api/v1/user_service.go · [email protected]https://www.vulncheck.com/advisories/memos-0.26.0-through-0.30.0-insufficient-session-expiration-on-password-change · [email protected]
EPSS history
Timeline
  • 03 SEP 03:32Z
    EPSS moved — → 0%
    epss
  • 01 SEP 15:18Z
    Memos 0.26.0 through 0.30.0 Insufficient Session Expiration on Password Change
    cvelistv5