CVE-2026-31241

The mem0 1.0.0 server lacks authentication and authorization controls for its memory deletion API endpoint (DELETE /memories). The endpoint allows unauthenticated users to delete memory records by specifying arbitrary user identifiers (e.g., user_id, run_id, agent_id) in the request query parameters. A remote attacker can exploit this by sending unauthenticated DELETE requests to erase memory data for any user, leading to unauthorized data loss and denial of service.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/mem0ai/mem0	Product
https://www.notion.so/CVE-2026-31241-35d1e139318881459ae5e6f0d7dc6f0f	Mitigation Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mem0:mem0:1.0.0:*:*:*:*:*:*:*

History

19 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) El servidor mem0 1.0.0 carece de controles de autenticación y autorización para su endpoint de API de eliminación de memoria (DELETE /memories). El endpoint permite a usuarios no autenticados eliminar registros de memoria especificando identificadores de usuario arbitrarios (p. ej., user_id, run_id, agent_id) en los parámetros de consulta de la solicitud. Un atacante remoto puede explotar esto enviando solicitudes DELETE no autenticadas para borrar datos de memoria de cualquier usuario, lo que lleva a una pérdida de datos no autorizada y denegación de servicio.

Information

Published : 2026-05-12 18:16

Updated : 2026-10-19 22:10

NVD link : CVE-2026-31241

Mitre link : CVE-2026-31241

CVE.ORG link : CVE-2026-31241

JSON object : View

Products Affected

mem0

mem0

CWE

CWE-306

Missing Authentication for Critical Function

CWE-862

Missing Authorization

{"id": "CVE-2026-31241", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31241", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-13T13:46:43.251069Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-05-12T18:16:52.557", "references": [{"url": "https://github.com/mem0ai/mem0", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://www.notion.so/CVE-2026-31241-35d1e139318881459ae5e6f0d7dc6f0f", "tags": ["Mitigation", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-306"}, {"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "The mem0 1.0.0 server lacks authentication and authorization controls for its memory deletion API endpoint (DELETE /memories). The endpoint allows unauthenticated users to delete memory records by specifying arbitrary user identifiers (e.g., user_id, run_id, agent_id) in the request query parameters. A remote attacker can exploit this by sending unauthenticated DELETE requests to erase memory data for any user, leading to unauthorized data loss and denial of service."}, {"lang": "es", "value": "El servidor mem0 1.0.0 carece de controles de autenticaci\u00f3n y autorizaci\u00f3n para su endpoint de API de eliminaci\u00f3n de memoria (DELETE /memories). El endpoint permite a usuarios no autenticados eliminar registros de memoria especificando identificadores de usuario arbitrarios (p. ej., user_id, run_id, agent_id) en los par\u00e1metros de consulta de la solicitud. Un atacante remoto puede explotar esto enviando solicitudes DELETE no autenticadas para borrar datos de memoria de cualquier usuario, lo que lleva a una p\u00e9rdida de datos no autorizada y denegaci\u00f3n de servicio."}], "lastModified": "2026-10-19T22:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mem0:mem0:1.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CBD5639B-9888-4EF9-8E41-CC05DBA4720E"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}