CVE-2026-31241: Mem0: kritik işlevde kimlik doğrulaması eksik

Açıklama (NVD)

The mem0 1.0.0 server lacks authentication and authorization controls for its memory deletion API endpoint (DELETE /memories). The endpoint allows unauthenticated users to delete memory records by specifying arbitrary user identifiers (e.g., user_id, run_id, agent_id) in the request query parameters. A remote attacker can exploit this by sending unauthenticated DELETE requests to erase memory data for any user, leading to unauthorized data loss and denial of service.

Özet bilgiler

Ürün

Mem0 Mem0

CVSS v3.1

6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

EPSS

%0,39 (yüzdelik 33)

CWE

CWE-306

Yama

Geçici çözüm

Etkilenen sürümler

Kaynaklar

• NVD kaydı
• github.com
• www.notion.so
• CWE-306