CVE-2026-31242
CriticalSummary
The mem0 v1.0.0 server lacks authentication and authorization controls for its memory reset functionality accessible via the DELETE /memories endpoint. An unauthenticated attacker can send a DELETE request that triggers a reset operation, leading to the execution of a DROP TABLE SQL statement.
Risk Assessment
This results in the deletion of the entire memory database table, causing catastrophic data loss and a complete denial of service for all users of the service. The organization is exposed to serious consequences related to data loss and service availability.
Recommendation
It is recommended to implement appropriate authentication and authorization mechanisms for the DELETE /memories endpoint to prevent unauthorized operations. Regular data backups should also be considered.
Original NVD description (English source)
The mem0 v1.0.0 server lacks authentication and authorization controls for its memory reset functionality accessible via the DELETE /memories endpoint. An unauthenticated attacker can send a DELETE request that triggers a reset operation, leading to the execution of a DROP TABLE SQL statement. This results in the deletion of the entire memory database table, causing catastrophic data loss and a complete denial of service for all users of the service.