The mem0 1.0.0 server allows unauthenticated users to issue a DELETE request to the /memories endpoint, which triggers a memory reset operation that internally executes a CREATE TABLE SQL statement. This flaw can lead to unintended table recreation, disruption of the database schema, potential data loss for stored memories, and availability problems for the memory management service.

The affected product is mem0 version 1.0.0. No vendor or additional product information is provided.

The vulnerability can be exploited remotely by any attacker capable of sending HTTP requests to the mem0 server. Without authentication or authorization controls on the DELETE /memories endpoint, an attacker can trigger the reset operation and cause database schema changes, data loss, and denial of service. It carries a CVSS score of 6.5, indicating moderate severity, while the EPSS score is less than 1% and it is not listed in CISA KEV. The exploitability therefore relies on the attacker’s ability to reach the mem0 service over the network and send a crafted DELETE request.