What is CVE-2026-84203?

CVE-2026-84203 is a high-severity vulnerability in Usememos Memos, classified under Insufficient Session Expiration. CVSS score: 8.1/10. Published 2026-09-01.

How severe is CVE-2026-84203?

High severity. CVSS v3 base score is 8.1 out of 10.

Vulnerability in Usememos Memos

CVE-2026-84203

Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user changes their password, allowing attackers to maintain account access. An attacker with a stolen refresh token can call the RefreshToken RPC to obtain new access tokens and rotate the refresh token indefinitely, bypassing the password change security measure.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.

Affected products

Usememos Memos

Weakness classification (CWE)

CWE-613 — Insufficient Session Expiration

References

disclosure@vulncheck.com (product)
disclosure@vulncheck.com (technical-description)
disclosure@vulncheck.com (technical-description)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-84203?: CVE-2026-84203 is a high-severity vulnerability in Usememos Memos, classified under Insufficient Session Expiration. CVSS score: 8.1/10. Published 2026-09-01.
How severe is CVE-2026-84203?: High severity. CVSS v3 base score is 8.1 out of 10.