The mem0 1.0.0 server exposes a memory creation endpoint (POST /memories) that lacks authentication and authorization checks. Users without verified credentials can submit arbitrary memory records, which the server accepts and stores without validation. This flaw allows attackers to inject malicious or spoofed memories, thereby corrupting the integrity of the dataset and potentially misleading other users who rely on the stored information.

The vulnerability applies to installations of the mem0 server version 1.0.0. No specific vendor or product name is listed in the CVE data, and the deployment context (cloud, on‑premise, containerized) is not specified. Any instance running the affected version and exposing the endpoint is susceptible.

Attackers can exploit the flaw remotely by sending unauthenticated POST requests to the publicly accessible endpoint. The CVSS score of 5.3 indicates a medium severity, and the EPSS score of <1% suggests a low probability of exploitation at this time. The vulnerability is not included in CISA’s KEV catalog. Nonetheless, because the endpoint is reachable without authentication, any application exposed to the internet is at risk of data corruption by unauthorized actors.