---
id: CVE-2026-59705
title: mem0 - OpenMemory API Unauthenticated Access via Memory Endpoints
summary: >-
  mem0's openmemory/api component contains an unauthenticated access
  vulnerability that allows unauthenticated attackers to read, write, and delete
  arbitrary user memories by accessing API routers registered without
  authentication middlewa…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-306
vendor: mem0
product: mem0
affected:
  - mem0 < a3154d5
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-07-08T13:09:22.095370Z'
exploitAvailable: true
published: '2026-07-07'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T14:18:00.388Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-59705'
references:
  - url: 'https://github.com/mem0ai/mem0/issues/6080'
    label: GitHub Issue
  - url: 'https://github.com/mem0ai/mem0'
    label: Product
  - url: >-
      https://github.com/mem0ai/mem0/commit/a3154d59e52386d4e1189c1f5f44819868f76514
    label: Patch Commit
  - url: >-
      https://www.vulncheck.com/advisories/mem0-openmemory-api-unauthenticated-access-via-memory-endpoints
tags:
  - cve.org
  - exploit-available
epss: 0.00804
epssPercentile: 0.55252
ingestedAt: '2026-09-24T15:45:56.725Z'
---

## Overview

mem0's openmemory/api component contains an unauthenticated access vulnerability that allows unauthenticated attackers to read, write, and delete arbitrary user memories by accessing API routers registered without authentication middleware. Attackers can supply arbitrary user_id parameters or directly access memory retrieval endpoints to expose private memory content, or invoke pause endpoints with global_pause=true to cause denial-of-service across all users.

## Affected

- `mem0 < a3154d5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.