From d3ff280218b7b53e705ac4825e30d1a61fffd106 Mon Sep 17 00:00:00 2001
From: Adonis Jimenez <271941740+donny-devops@users.noreply.github.com>
Date: Fri, 31 Jul 2026 23:58:12 -0400
Subject: [PATCH] Improve GHSA-jfv9-68m5-gjjr

---
 .../2026/05/GHSA-jfv9-68m5-gjjr/GHSA-jfv9-68m5-gjjr.json      | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/advisories/github-reviewed/2026/05/GHSA-jfv9-68m5-gjjr/GHSA-jfv9-68m5-gjjr.json b/advisories/github-reviewed/2026/05/GHSA-jfv9-68m5-gjjr/GHSA-jfv9-68m5-gjjr.json
index 039df9b27cef..d852d08c2804 100644
--- a/advisories/github-reviewed/2026/05/GHSA-jfv9-68m5-gjjr/GHSA-jfv9-68m5-gjjr.json
+++ b/advisories/github-reviewed/2026/05/GHSA-jfv9-68m5-gjjr/GHSA-jfv9-68m5-gjjr.json
@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-jfv9-68m5-gjjr",
-  "modified": "2026-05-28T19:13:30Z",
+  "modified": "2026-05-28T19:13:31Z",
   "published": "2026-05-12T18:30:41Z",
   "aliases": [
     "CVE-2026-31240"
   ],
   "summary": "mem0 server lacks authentication and authorization controls for its memory management API endpoints",
-  "details": "The mem0 1.0.0 server lacks authentication and authorization controls for its memory management API endpoints. Critical functions such as updating memory records (PUT /memories/{memory_id}) are exposed without any verification of the requester's identity or permissions. A remote attacker can exploit this by sending unauthenticated requests to modify, overwrite, or delete arbitrary memory records, leading to unauthorized data manipulation and potential data loss.",
+  "details": "The mem0 server in version 1.0.0 exposes critical memory‑management API endpoints without authentication or authorization. Endpoints such as PUT /memories/{memory_id} allow any remote user to modify, overwrite, or delete memory records without verifying identity or permissions. This results in unauthorized data manipulation and potential data loss.\n\nSeverity\nHigh (CVSS 7.5)  \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\n\nThis vulnerability allows remote, unauthenticated modification of stored data. No privileges or user interaction are required.\n\nTechnical Details\nThe mem0 server’s memory‑management endpoints lack authentication middleware. Requests to endpoints such as:\n\nPUT /memories/{memory_id}\n\nDELETE /memories/{memory_id}\n\nare processed without verifying the requester’s identity. This allows arbitrary modification or deletion of memory records. The issue corresponds to CWE‑306: Missing Authentication for Critical Function.\n\nProof‑of‑Concept (Safe)\nA remote attacker can send an unauthenticated HTTP request:\n\nCode\nPUT /memories/123\nContent-Type: application/json\n\n{\n  \"text\": \"attacker-modified content\"\n}\nThe server accepts the request and overwrites the memory record, demonstrating the lack of authentication and authorization.\n\nAffected Versions\nmem0ai (pip) ≤ 1.0.0  \n\nPatched Version\nNone currently available.\n\nRemediation\nImplement authentication and authorization controls for all memory‑management endpoints. Require valid tokens for all state‑changing operations and enforce ownership checks. Release a patched version with secure middleware and proper access control.",
   "severity": [
     {
       "type": "CVSS_V3",