VULNERABILITY INTELLIGENCE

CVE-2026-31245

CVSS score5.3 MEDIUM
EPSS probability0.34%
CISA KEVNot currently listed
Published2026-05-12
Last modified2026-10-19
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Description

The mem0 1.0.0 server lacks authentication and authorization controls for its memory creation API endpoint (POST /memories). The endpoint allows unauthenticated users to submit arbitrary memory records without verifying their identity or permissions. A remote attacker can exploit this by sending unauthenticated POST requests to create malicious or spoofed memory entries in the database, leading to unauthorized data injection and potential data pollution.

Weakness classification

  • 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-306

Primary references