CVE-2026-84203

Memos 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user changes their password, a session-expiration flaw (CWE-613). An attacker who has obtained a victim's refresh token can repeatedly call the RefreshToken RPC to mint new access tokens and rotate the refresh token indefinitely, retaining access even after the password is changed. This defeats the intended security effect of a password reset, giving the attacker persistent network-based access to the account (CVSS 4.0: 8.6, High). Any Memos deployment running versions 0.26.0 through 0.30.0 is affected, though exploitation first requires the attacker to have stolen a valid refresh token. No exploitation is currently known: there is no public proof-of-concept, the issue is not in CISA KEV, and EPSS estimates only a 0.3% chance of exploitation in the next 30 days.

What to do: Upgrade Memos to a release newer than 0.30.0 that revokes refresh tokens on password change, checking upstream release notes for the patched version. Until patched, do not treat a password change as sufficient containment after a suspected token or credential theft — instead have users sign out of all sessions or manually revoke refresh tokens, and limit internet exposure of Memos instances. Monitor authentication logs for repeated RefreshToken RPC activity from unfamiliar clients, since that is the signature of this persistence technique.