The mem0 1.0.0 server exposes its memory management API endpoints without any authentication or authorization checks. This allows a remote actor to send unauthenticated requests to perform critical functions such as updating memory records (PUT /memories/{memory_id}). The result is that an attacker can modify, overwrite, or delete arbitrary memory records, leading to unauthorized data manipulation and potential loss of data. This flaw represents a serious compromise of data integrity and confidentiality for any system that relies on mem0 for persistent storage.

The vulnerability affects the mem0 1.0.0 server. No other vendor or product information is listed in the CVE data.

Because the API is openly exposed, the attack vector would be unauthenticated HTTP requests to the network. The CVSS score of 7.5 indicates a high severity, underscoring the potential to compromise data integrity and availability. The EPSS score of less than 1%, however, signals that the likelihood of exploitation is currently low, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the absence of authentication and authorization checks remains a significant weakness (CWE‑306).