The mem0 1.0.0 server contains a flaw where the memory deletion API endpoint (DELETE /memories) does not enforce authentication or authorization. This omission means an unauthenticated attacker can supply any user identifiers as query parameters and delete memory records belonging to any user. The effect of such an operation is unauthorized deletion of data, resulting in data loss and potentially a denial of service for legitimate users.

This vulnerability affects deployments of mem0 version 1.0.0. No specific vendor or product names are provided, and no official patch is currently available.

The exploitability of this flaw remains straightforward: it requires only the ability to send unauthenticated HTTP DELETE requests to the exposed API endpoint, which is feasible over a network. Because any user, run, or agent identifier can be specified, an attacker can target arbitrary records. The likely attack vector is remote network access. EPSS score of <1% and CVSS score of 6.5 indicate moderate severity, but combined with the absence of authentication/authorization controls (CWE-306, CWE-862) and the ease of exploitation, the overall risk remains high.