Skip to content

[GHSA-jfv9-68m5-gjjr] mem0 server lacks authentication and authorization controls for its memory management API endpoints #8930

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
donny-devops wants to merge 1 commit into
base: donny-devops/advisory-improvement-8930
Choose a base branch
from
Open

[GHSA-jfv9-68m5-gjjr] mem0 server lacks authentication and authorization controls for its memory management API endpoints #8930

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions advisories/github-reviewed/2026/05/GHSA-jfv9-68m5-gjjr/GHSA-jfv9-68m5-gjjr.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jfv9-68m5-gjjr",
"modified": "2026-05-28T19:13:30Z",
"modified": "2026-05-28T19:13:31Z",
"published": "2026-05-12T18:30:41Z",
"aliases": [
"CVE-2026-31240"
],
"summary": "mem0 server lacks authentication and authorization controls for its memory management API endpoints",
"details": "The mem0 1.0.0 server lacks authentication and authorization controls for its memory management API endpoints. Critical functions such as updating memory records (PUT /memories/{memory_id}) are exposed without any verification of the requester's identity or permissions. A remote attacker can exploit this by sending unauthenticated requests to modify, overwrite, or delete arbitrary memory records, leading to unauthorized data manipulation and potential data loss.",
"details": "The mem0 server in version 1.0.0 exposes critical memory‑management API endpoints without authentication or authorization. Endpoints such as PUT /memories/{memory_id} allow any remote user to modify, overwrite, or delete memory records without verifying identity or permissions. This results in unauthorized data manipulation and potential data loss.\n\nSeverity\nHigh (CVSS 7.5) \nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\n\nThis vulnerability allows remote, unauthenticated modification of stored data. No privileges or user interaction are required.\n\nTechnical Details\nThe mem0 server’s memory‑management endpoints lack authentication middleware. Requests to endpoints such as:\n\nPUT /memories/{memory_id}\n\nDELETE /memories/{memory_id}\n\nare processed without verifying the requester’s identity. This allows arbitrary modification or deletion of memory records. The issue corresponds to CWE‑306: Missing Authentication for Critical Function.\n\nProof‑of‑Concept (Safe)\nA remote attacker can send an unauthenticated HTTP request:\n\nCode\nPUT /memories/123\nContent-Type: application/json\n\n{\n \"text\": \"attacker-modified content\"\n}\nThe server accepts the request and overwrites the memory record, demonstrating the lack of authentication and authorization.\n\nAffected Versions\nmem0ai (pip) ≤ 1.0.0 \n\nPatched Version\nNone currently available.\n\nRemediation\nImplement authentication and authorization controls for all memory‑management endpoints. Require valid tokens for all state‑changing operations and enforce ownership checks. Release a patched version with secure middleware and proper access control.",
"severity": [
{
"type": "CVSS_V3",
Expand Down