GHSA-cgx8-qgvr-f7vf

Suggest an improvement
Source
https://github.com/advisories/GHSA-cgx8-qgvr-f7vf
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-cgx8-qgvr-f7vf/GHSA-cgx8-qgvr-f7vf.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-cgx8-qgvr-f7vf
Aliases
Published
2026-05-12T18:30:41Z
Modified
2026-07-13T16:43:14Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
mem0 server lacks authentication and authorization controls for its memory creation API endpoint
Details

The mem0 1.0.0 server lacks authentication and authorization controls for its memory creation API endpoint (POST /memories). The endpoint allows unauthenticated users to submit arbitrary memory records without verifying their identity or permissions. A remote attacker can exploit this by sending unauthenticated POST requests to create malicious or spoofed memory entries in the database, leading to unauthorized data injection and potential data pollution.

Database specific 
{
    "cwe_ids":  [
        "CWE-306"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-05-27T22:46:51Z",
    "nvd_published_at":  "2026-05-12T18:16:53Z",
    "severity":  "MODERATE"
}
References

Affected packages

PyPI / mem0ai

Package

Name
mem0ai
View open source insights on deps.dev
Purl
pkg:pypi/mem0ai

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Last Affected
1.0.0

Affected versions

0.*
0.0.1
0.0.2
0.0.3
0.0.4
0.0.5
0.0.6
0.0.7
0.0.8
0.0.9
0.0.10
0.0.11
0.0.12
0.0.13
0.0.14
0.0.15
0.0.16
0.0.17
0.0.18
0.0.19
0.0.20rc1
0.0.20
0.0.21
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.9
0.1.10
0.1.11
0.1.12
0.1.13
0.1.14
0.1.15
0.1.16
0.1.17
0.1.18
0.1.19
0.1.20a0
0.1.20
0.1.21
0.1.22
0.1.23
0.1.24
0.1.25
0.1.26
0.1.27
0.1.28
0.1.29
0.1.30
0.1.31
0.1.32
0.1.33
0.1.34
0.1.35
0.1.36
0.1.37
0.1.38
0.1.39
0.1.40
0.1.41
0.1.42
0.1.43
0.1.44
0.1.45rc1
0.1.45
0.1.46
0.1.47
0.1.48
0.1.49
0.1.50
0.1.52
0.1.53
0.1.54
0.1.55
0.1.56
0.1.57
0.1.58
0.1.59
0.1.60
0.1.61
0.1.62
0.1.63
0.1.65
0.1.66
0.1.67
0.1.69
0.1.70
0.1.71
0.1.72
0.1.73
0.1.74
0.1.75
0.1.76
0.1.77
0.1.78a0
0.1.78a1
0.1.78a2
0.1.78
0.1.79
0.1.80
0.1.81a0
0.1.81a1
0.1.81a2
0.1.81
0.1.82
0.1.83
0.1.84a1
0.1.84
0.1.85
0.1.86
0.1.87
0.1.88
0.1.89
0.1.90
0.1.91
0.1.92
0.1.93
0.1.94
0.1.95
0.1.96rc1
0.1.96
0.1.97
0.1.98
0.1.99a0
0.1.99a1
0.1.99a2
0.1.99a3
0.1.99
0.1.100
0.1.101
0.1.102
0.1.103
0.1.104
0.1.106
0.1.107rc1
0.1.107rc2
0.1.107
0.1.108
0.1.109
0.1.110
0.1.111
0.1.112
0.1.113
0.1.114
0.1.115
0.1.116
0.1.117
0.1.118
1.*
1.0.0b0
1.0.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-cgx8-qgvr-f7vf/GHSA-cgx8-qgvr-f7vf.json"