The mem0 v1.0.0 server exposes a DELETE /memories endpoint without any authentication or authorization checks. This flaw allows an unauthenticated user to trigger a reset operation that executes a DROP TABLE SQL statement, erasing the entire memory database. Consequently, all stored data is lost and the service becomes unavailable to all users, constituting a severe data loss and a complete denial of service.

The vulnerability affects the mem0 v1.0.0 server. No other vendors or product versions are known to be impacted at this time. It is inferred that older releases that retain the same unauthenticated DELETE /memories endpoint may also be affected, but no explicit confirmation is available.

Because the exploit requires only an unauthenticated HTTP DELETE request, the attack vector is remote over the network. The lack of authentication makes the vulnerability trivially exploitable once the endpoint is reachable. A successful attack results in immediate data destruction and service outage, which would be catastrophic for any organization relying on the mem0 service. No exploitation probability score is available and the vulnerability is not listed in the CISA KEV catalog, but the high impact and ease of exploitation warrant urgent attention.