Detections
Analytics

SCA: security update for github.com/usememos/memos (GHSA-mr34-8733-grr2)

high Tenable Self-Hosted Container Security Plugin ID 438675

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Memos is a privacy-first, lightweight note-taking service that uses Access Tokens to authenticate
 application access. When a user changes their password, the existing list of Access Tokens stay valid
 instead of expiring. If a user finds that their account has been compromised, they can update their
 password. In versions up to and including 0.18.1, though, the bad actor will still have access to their
 account because the bad actor's Access Token stays on the list as a valid token. The user will have to
 manually delete the bad actor's Access Token to secure their account. The list of Access Tokens has a
 generic Description which makes it hard to pinpoint a bad actor in a list of Access Tokens. A known
 patched version of Memos isn't available. To improve Memos security, all Access Tokens will need to be
 revoked when a user changes their password. This removes the session for all the user's devices and
 prompts the user to log in again. One can treat the old Access Tokens as "invalid" because those Access
 Tokens were created with the older password. (CVE-2024-21635)

Solution

Update the github.com/usememos/memos library and its related packages to version 0.18.2 or later.

See Also

https://github.com/advisories/GHSA-mr34-8733-grr2

Plugin Details

Severity: High

ID: 438675

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 3/12/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.73

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N

CVSS Score Source: CVE-2024-21635

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 7.1

Threat Score: 5.7

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/14/2025

Vulnerability Publication Date: 11/14/2025

Reference Information

CVE: CVE-2024-21635

cwe: CWE-287