PatchTheCVECVE-2024-21635: Memos is a privacy-first, lightweight note-taking service that uses Access Tokens to authenticate application
CVE-2024-21635 is a high-severity flaw (CVSS 7.5) affecting memos. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Memos is a privacy-first, lightweight note-taking service that uses Access Tokens to authenticate application access. When a user changes their password, the existing list of Access Tokens stay valid instead of expiring. If a user finds that their account has been compromised, they can update their password. In versions up to and including 0.18.1, though, the bad actor will still have access to their account because the bad actor's Access Token s
Why this priority
- High severity
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.5 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.3% (top 77%) |
| CISA exploited list | No |
| Weakness | CWE-287 |
| Published | 2025-11-14 |
| Last modified | 2026-10-02 |
Last updated 2026-10-02 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2024-21635?
memos: upgrade to newer than 0.18.1. Exact commands for each OS are on this page.
Is CVE-2024-21635 being exploited?
CVE-2024-21635 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2024-21635 affect?
CVE-2024-21635 affects memos. Severity is high (CVSS 7.5). Memos is a privacy-first, lightweight note-taking service that uses Access Tokens to authenticate application access. When a user changes their password, the existing list of Access Tokens stay valid instead of expiring. If a user finds tha
How urgent is CVE-2024-21635?
Priority 42/100. High severity; Public exploit reference; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2025-65798 MEDIUM 5.4 DOWNGRADE Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily m
- CVE-2025-65796 MEDIUM 4.3 DOWNGRADE Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily d
- CVE-2025-65799 MEDIUM 4.3 DOWNGRADE A lack of file name validation or verification in the Attachment service of usememos memos v0.25.2 allows atta
- CVE-2025-65795 HIGH 7.5 DOWNGRADE Incorrect access control in the /api/v1/user endpoint of usememos memos v0.25.2 allows unauthorized attackers
- CVE-2025-65797 MEDIUM 6.5 DOWNGRADE Incorrect access control in the Identity Provider service of usememos memos v0.25.2 allows attackers with low-