The vulnerability in mcp-memory-service allows a client that only possesses an OAuth token with the read scope to invoke end‑points that perform write and delete operations on the semantic memory layer. The JSON‑RPC handler at /mcp blindly forwards tool calls such as store_memory and delete_memory to underlying mutating functions, ignoring the stricter write scope that is correctly required by the REST API. Consequently, an attacker can compromise the integrity of stored memories without needing higher privileges, potentially tampering with AI application knowledge bases. The weakness was identified as CWE‑862: Missing Authorization.

Affected vendors and products include Doobidoo’s mcp‑memory‑service. Versions prior to 10.65.3 use an HTTP MCP JSON‑RPC endpoint that requires only read scope for all operations. The fix is included in release 10.65.3; any installation running an earlier version or using that API endpoint is vulnerable.

The CVSS score of 8.1 indicates a high‑severity impact. Although EPSS data is unavailable, the vulnerability is not currently listed in CISA’s KEV catalogue. The likely attack vector is remote; an adversary with a read‑only OAuth token can directly call /mcp and exploit the flaw. Successful exploitation would allow unauthorized data deletion or addition, undermining system reliability and the correctness of AI inference.