CVE-2026-59705

Received Received - Intake

Unauthenticated Memory Access in mem0 API

Publication date: 2026-07-07

Last updated on: 2026-07-07

Assigner: VulnCheck

Description

mem0's openmemory/api component contains an unauthenticated access vulnerability that allows unauthenticated attackers to read, write, and delete arbitrary user memories by accessing API routers registered without authentication middleware. Attackers can supply arbitrary user_id parameters or directly access memory retrieval endpoints to expose private memory content, or invoke pause endpoints with global_pause=true to cause denial-of-service across all users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-07

Last Modified

2026-07-07

Generated

2026-07-08

AI Q&A

2026-07-08

EPSS Evaluated

N/A

NVD

CVE-2026-59705

EUVD

EUVD-2026-42126

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

The vulnerability exists in mem0's openmemory/api component, where certain API routers are registered without authentication middleware. This allows unauthenticated attackers to read, write, and delete arbitrary user memories by supplying arbitrary user_id parameters or directly accessing memory retrieval endpoints.

Additionally, attackers can invoke pause endpoints with a global_pause=true parameter, causing a denial-of-service condition that affects all users.

Impact Analysis

This vulnerability can have severe impacts including unauthorized access to private user memories, modification or deletion of user data, and disruption of service for all users through denial-of-service attacks.

Hi! I’m here to help you understand CVE-2026-59705. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70