Mem0 Memory Reset Functionality Vulnerability Leading to Data Loss and Denial-of-Service

A vulnerability in the Mem0 server version 1.0.0 allows for unauthorized memory resets through the DELETE /memories endpoint. The server lacks proper authentication and authorization, enabling an unauthenticated attacker to send a DELETE request that triggers a reset operation. This exploitation executes a DROP TABLE SQL statement, deleting the entire memory database table. The consequence is significant data loss and a complete denial-of-service for all users of the service.

Impact

Exploitation of this vulnerability results in the unauthorized deletion of the memory database table, causing severe data loss and a total denial-of-service for all users.