Authentication and Authorization Flaw in mem0 Memory Management API

CVE-2026-31240

What is CVE-2026-31240?

The mem0 1.0.0 server contains a severe vulnerability in its memory management API endpoints due to the lack of proper authentication and authorization controls. This oversight exposes sensitive functions such as updating memory records (PUT /memories/{memory_id}) to unauthenticated requests. Malicious actors can exploit this weakness to send unauthorized requests, allowing them to modify, overwrite, or delete arbitrary memory records. Such unauthorized access poses significant risks, including data manipulation and potential data loss, making it imperative for users to apply necessary patches and enforce robust security practices.

References