{"id":"CVE-2026-31245","aliases":["GHSA-cgx8-qgvr-f7vf","PYSEC-2026-2633"],"title":"mem0 server lacks authentication and authorization controls for its memory creation API endpoint","summary":"mem0 server lacks authentication and authorization controls for its memory creation API endpoint","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","vendor":"mem0ai","product":"mem0ai","ecosystem":"pip","affected":["mem0ai <= 1.0.0"],"published":"2026-05-12","updated":"2026-07-13","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-cgx8-qgvr-f7vf","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31245"},{"url":"https://github.com/mem0ai/mem0"},{"url":"https://www.notion.so/CVE-2026-31245-35d1e1393188810aab57ff9b49146b05"}],"tags":["osv","pip"],"epss":0.00335,"epssPercentile":0.26991,"ingestedAt":"2026-07-13T18:57:56.455Z","slug":"CVE-2026-31245","body":"## Overview\n\nThe mem0 1.0.0 server lacks authentication and authorization controls for its memory creation API endpoint (POST /memories). The endpoint allows unauthenticated users to submit arbitrary memory records without verifying their identity or permissions. A remote attacker can exploit this by sending unauthenticated POST requests to create malicious or spoofed memory entries in the database, leading to unauthorized data injection and potential data pollution.\n\n## Affected packages\n\n- `mem0ai <= 1.0.0`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}