Is CVE-2026-84203 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-84203?

CVE-2026-84203 has a CVSS v3 severity of HIGH (8.1).

Back

CVE-2026-84203

Description

Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user changes their password, allowing attackers to maintain account access. An attacker with a stolen refresh token can call the RefreshToken RPC to obtain new access tokens and rotate the refresh token indefinitely, bypassing the password change security measure.