CVE-2026-31244

The mem0 1.0.0 server lacks authentication and authorization controls for its memory deletion API endpoint (DELETE /memories/{memory_id}). The endpoint allows unauthenticated users to delete arbitrary memory records without verifying their identity or permissions. A remote attacker can exploit this by sending unauthenticated DELETE requests to remove any memory entry from the database, leading to unauthorized data loss and potential denial of service.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/mem0ai/mem0	Product
https://www.notion.so/CVE-2026-31244-35d1e1393188818b8039c50adc75996c	Mitigation Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mem0:mem0:1.0.0:*:*:*:*:*:*:*

History

19 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) El servidor mem0 1.0.0 carece de controles de autenticación y autorización para su endpoint de API de eliminación de memoria (DELETE /memories/{memory_id}). El endpoint permite a usuarios no autenticados eliminar registros de memoria arbitrarios sin verificar su identidad o permisos. Un atacante remoto puede explotar esto enviando solicitudes DELETE no autenticadas para eliminar cualquier entrada de memoria de la base de datos, lo que lleva a una pérdida de datos no autorizada y una potencial denegación de servicio.

Information

Published : 2026-05-12 18:16

Updated : 2026-10-19 22:10

NVD link : CVE-2026-31244

Mitre link : CVE-2026-31244

CVE.ORG link : CVE-2026-31244

JSON object : View

Products Affected

mem0

mem0

CWE

CWE-306

Missing Authentication for Critical Function

CWE-862

Missing Authorization

{"id": "CVE-2026-31244", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31244", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-13T13:27:00.702704Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-05-12T18:16:52.897", "references": [{"url": "https://github.com/mem0ai/mem0", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://www.notion.so/CVE-2026-31244-35d1e1393188818b8039c50adc75996c", "tags": ["Mitigation", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-306"}, {"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "The mem0 1.0.0 server lacks authentication and authorization controls for its memory deletion API endpoint (DELETE /memories/{memory_id}). The endpoint allows unauthenticated users to delete arbitrary memory records without verifying their identity or permissions. A remote attacker can exploit this by sending unauthenticated DELETE requests to remove any memory entry from the database, leading to unauthorized data loss and potential denial of service."}, {"lang": "es", "value": "El servidor mem0 1.0.0 carece de controles de autenticaci\u00f3n y autorizaci\u00f3n para su endpoint de API de eliminaci\u00f3n de memoria (DELETE /memories/{memory_id}). El endpoint permite a usuarios no autenticados eliminar registros de memoria arbitrarios sin verificar su identidad o permisos. Un atacante remoto puede explotar esto enviando solicitudes DELETE no autenticadas para eliminar cualquier entrada de memoria de la base de datos, lo que lleva a una p\u00e9rdida de datos no autorizada y una potencial denegaci\u00f3n de servicio."}], "lastModified": "2026-10-19T22:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mem0:mem0:1.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CBD5639B-9888-4EF9-8E41-CC05DBA4720E"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}