The mem0 1.0.0 server contains a flaw where the memory deletion API endpoint (DELETE /memories) does not enforce authentication or authorization. This omission means an unauthenticated attacker can supply any user identifiers as query parameters and delete memory records belonging to any user. The effect of such an operation is unauthorized deletion of data, resulting in data loss and potentially a denial of service for legitimate users.

This vulnerability affects deployments of mem0 version 1.0.0. No specific vendor or product names are provided, and no official patch is currently available.

The exploitability of this flaw is straightforward: it requires only the ability to send unauthenticated HTTP DELETE requests to the exposed API endpoint, which is feasible over a network. Because any user, run, or agent identifier can be specified, an attacker can target arbitrary records. The likely attack vector is remote network access. With no EPSS, CVSS, or KEV data available, the risk is assessed as high based on the severity of the impact and the low barrier to exploitation.