CyberRota Analysis
AI-GeneratedThe openmemory/api component of mem0 is vulnerable to unauthenticated access, enabling attackers to read, write, and delete arbitrary user memories by exploiting API routers lacking authentication middleware. This critical vulnerability can lead to exposure of sensitive data and denial-of-service across all users when global_pause is invoked. Organizations utilizing this component should prioritize immediate remediation to protect against potential data breaches and service disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
mem0's openmemory/api component contains an unauthenticated access vulnerability that allows unauthenticated attackers to read, write, and delete arbitrary user memories by accessing API routers registered without authentication middleware. Attackers can supply arbitrary user_id parameters or directly access memory retrieval endpoints to expose private memory content, or invoke pause endpoints with global_pause=true to cause denial-of-service across all users.