The mem0 server version 1.0.0 contains a missing authentication and authorization check on the memory creation endpoint (POST /memories). Unauthenticated users can submit arbitrary memory records, which the server stores in the database without verifying identity or permissions. Attackers can thus inject malicious or spoofed memories, leading to data pollution and potentially corrupting user data integrity. The weakness is an improper authorization flaw that allows unauthorized creation of resources.

Specific affected vendors, product names, and versions are not listed in the CVE data. The vulnerability pertains to the mem0 server component, but the precise deployment context (e.g., cloud hosting, on-premise installation) is unknown.

The vulnerability can be exploited remotely by sending crafted POST requests to the exposed endpoint. There is no published CVSS score; the EPSS is unavailable, and the issue is not listed in CISA’s KEV catalog. Nevertheless, because the endpoint is publicly reachable without authentication, the potential impact is high if the application is exposed to the internet. Attackers can inject data without needing elevated privileges, indicating a risk of widespread data corruption potentially affecting all users of the affected instance.