Memos CVE-2026-84203

Exploitation requires that the attacker first obtain a valid Memos refresh token through a separate attack vector such as cross-site scripting, phishing, session hijacking, or network interception - possession of this token is the sole prerequisite enforced by the server. The target instance must be running Memos 0.26.0 through 0.30.0. The vulnerability is most impactful when the victim changes their password in response to a suspected compromise: that action, which normally terminates session access, has no effect here. Exploitation is limited to accounts for which the attacker already holds a refresh token; unauthenticated attackers with no prior token cannot exploit this flaw directly. No special server-side configuration or feature flag is required - the RefreshToken RPC is a standard endpoint in the affected versions.

The CVSS 4.0 score of 8.6 reflects network-accessible exploitation (AV:N), low complexity (AC:L), no special attack requirements (AT:N), low privilege prerequisite (PR:L, representing possession of a stolen token), and no user interaction (UI:N), with High impact on both confidentiality and integrity (VC:H/VI:H). The real-world risk is specifically elevated as a post-compromise persistence mechanism: the attack is most dangerous after the victim has discovered and attempted to remediate an account compromise. A user changing their password to evict an attacker will find the password change is entirely ineffective if the attacker holds a refresh token. EPSS data is absent from the provided intelligence, and the vulnerability is not currently listed in CISA KEV. No public exploit code is referenced. Offsetting the severity, initial token theft is a prerequisite - this is not direct unauthenticated access - which limits the reachable population to accounts already partially compromised through phishing, XSS, network interception, or credential exposure.

An attacker intercepts or steals a valid Memos refresh token - via XSS, phishing, or network interception - and learns the victim has changed their password in response. Rather than losing access, the attacker calls the RefreshToken RPC with the stolen token, receives a new access token and a rotated refresh token, and continues operating on the victim's account. The attacker can repeat this rotation indefinitely, maintaining persistent account access regardless of further password changes by the victim.