Skip to content
OpenAdvisories
High · 7.5 CVE-2026-31240 EUVD-2026-29563GHSA-jfv9-68m5-gjjrPYSEC-2026-2635

mem0 server lacks authentication and authorization controls for its memory management API endpoints

Published May 12, 2026 · Updated May 14, 2026 · Assigned by mitre

Description

The mem0 1.0.0 server lacks authentication and authorization controls for its memory management API endpoints. Critical functions such as updating memory records (PUT /memories/{memory_id}) are exposed without any verification of the requester's identity or permissions. A remote attacker can exploit this by sending unauthenticated requests to modify, overwrite, or delete arbitrary memory records, leading to unauthorized data manipulation and potential data loss.

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI mem0ai <= 1.0.0 — GHSA-jfv9-68m5-gjjr

References