GHSA-gq6f-qwv9-rf4j

Suggest an improvement
Source
https://github.com/advisories/GHSA-gq6f-qwv9-rf4j
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-gq6f-qwv9-rf4j/GHSA-gq6f-qwv9-rf4j.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-gq6f-qwv9-rf4j
Aliases
Published
2026-05-12T18:30:41Z
Modified
2026-07-13T16:43:43Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L CVSS Calculator
Summary
mem0 server lacks authentication and authorization controls for its memory deletion API endpoint
Details

The mem0 1.0.0 server lacks authentication and authorization controls for its memory deletion API endpoint (DELETE /memories). The endpoint allows unauthenticated users to delete memory records by specifying arbitrary user identifiers (e.g., user_id, run_id, agent_id) in the request query parameters. A remote attacker can exploit this by sending unauthenticated DELETE requests to erase memory data for any user, leading to unauthorized data loss and denial of service.

Database specific 
{
    "cwe_ids":  [
        "CWE-306"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-05-27T22:46:15Z",
    "nvd_published_at":  "2026-05-12T18:16:52Z",
    "severity":  "MODERATE"
}
References

Affected packages

PyPI / mem0ai

Package

Name
mem0ai
View open source insights on deps.dev
Purl
pkg:pypi/mem0ai

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Last Affected
1.0.0

Affected versions

0.*
0.0.1
0.0.2
0.0.3
0.0.4
0.0.5
0.0.6
0.0.7
0.0.8
0.0.9
0.0.10
0.0.11
0.0.12
0.0.13
0.0.14
0.0.15
0.0.16
0.0.17
0.0.18
0.0.19
0.0.20rc1
0.0.20
0.0.21
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.9
0.1.10
0.1.11
0.1.12
0.1.13
0.1.14
0.1.15
0.1.16
0.1.17
0.1.18
0.1.19
0.1.20a0
0.1.20
0.1.21
0.1.22
0.1.23
0.1.24
0.1.25
0.1.26
0.1.27
0.1.28
0.1.29
0.1.30
0.1.31
0.1.32
0.1.33
0.1.34
0.1.35
0.1.36
0.1.37
0.1.38
0.1.39
0.1.40
0.1.41
0.1.42
0.1.43
0.1.44
0.1.45rc1
0.1.45
0.1.46
0.1.47
0.1.48
0.1.49
0.1.50
0.1.52
0.1.53
0.1.54
0.1.55
0.1.56
0.1.57
0.1.58
0.1.59
0.1.60
0.1.61
0.1.62
0.1.63
0.1.65
0.1.66
0.1.67
0.1.69
0.1.70
0.1.71
0.1.72
0.1.73
0.1.74
0.1.75
0.1.76
0.1.77
0.1.78a0
0.1.78a1
0.1.78a2
0.1.78
0.1.79
0.1.80
0.1.81a0
0.1.81a1
0.1.81a2
0.1.81
0.1.82
0.1.83
0.1.84a1
0.1.84
0.1.85
0.1.86
0.1.87
0.1.88
0.1.89
0.1.90
0.1.91
0.1.92
0.1.93
0.1.94
0.1.95
0.1.96rc1
0.1.96
0.1.97
0.1.98
0.1.99a0
0.1.99a1
0.1.99a2
0.1.99a3
0.1.99
0.1.100
0.1.101
0.1.102
0.1.103
0.1.104
0.1.106
0.1.107rc1
0.1.107rc2
0.1.107
0.1.108
0.1.109
0.1.110
0.1.111
0.1.112
0.1.113
0.1.114
0.1.115
0.1.116
0.1.117
0.1.118
1.*
1.0.0b0
1.0.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-gq6f-qwv9-rf4j/GHSA-gq6f-qwv9-rf4j.json"