Description
Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user changes their password, allowing attackers to maintain account access. An attacker with a stolen refresh token can call the RefreshToken RPC to obtain new access tokens and rotate the refresh token indefinitely, bypassing the password change security measure.
Published: 2026-09-01
Score: 8.6 High
EPSS: < 1% Very Low
KEV: No
Impact: Account takeover via token reuse
Action: Apply Patch
AI Analysis

Impact

Memos 0.26.0 through 0.30.0 do not invalidate refresh tokens after a user changes their password. An attacker who has a valid refresh token can repeatedly call the RefreshToken RPC, obtaining new access tokens and rotating the token endlessly. This allows continued access to the account even after a password change intended to mitigate compromise.

Affected Systems

The vulnerability affects the usememos memos application, specifically all versions from 0.26.0 up to and including 0.30.0. Users of those releases who change their password will continue to retain session credentials and can be accessed through stolen refresh tokens.

Risk and Exploitability

The CVSS score of 8.6 indicates a high severity vulnerability. EPSS is not available, so the current exploit likelihood cannot be quantified, but the vulnerability is listed as not part of the CISA KEV catalog. The attack vector is likely remote: possession of a stolen refresh token grants the attacker continuous authorization via the RefreshToken RPC, bypassing the password change security measure.

Generated by OpenCVE AI on September 2, 2026 at 03:13 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the memos application to a version that implements refresh token revocation after password change.
  • Revoke all active refresh tokens for affected users, for example by resetting each user’s password or using any available administrative endpoint to clear sessions.
  • If possible, disable or limit the issuance or use of refresh tokens temporarily until the patch is applied. Monitor authentication logs for abnormal token refresh activity to detect ongoing misuse.

Generated by OpenCVE AI on September 2, 2026 at 03:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 02 Sep 2026 08:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 01 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
Description Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user changes their password, allowing attackers to maintain account access. An attacker with a stolen refresh token can call the RefreshToken RPC to obtain new access tokens and rotate the refresh token indefinitely, bypassing the password change security measure.
Title Memos 0.26.0 through 0.30.0 Insufficient Session Expiration on Password Change
First Time appeared Usememos
Usememos memos
Weaknesses CWE-613
CPEs cpe:2.3:a:usememos:memos:*:*:*:*:*:*:*:*
Vendors & Products Usememos
Usememos memos
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Usememos Memos
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-01T18:05:05.563Z

Reserved: 2026-09-01T11:03:27.973Z

Link: CVE-2026-84203

cve-icon Vulnrichment

Updated: 2026-09-01T18:03:41.467Z

cve-icon NVD

Status : Deferred

Published: 2026-09-01T16:17:34.600

Modified: 2026-09-08T20:18:59.270

Link: CVE-2026-84203

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-02T03:15:04Z

Weaknesses
  • CWE-613

    Insufficient Session Expiration