Mem0 Memory Management Service Unauthenticated Memory Reset Vulnerability

A vulnerability in the Mem0 server version 1.0.0 allows for unauthorized memory reset and table re-creation actions. The issue arises from the absence of authentication and authorization controls on the DELETE /memories endpoint. This flaw enables an unauthenticated attacker to send a DELETE request that initiates a memory reset, which in turn executes a CREATE TABLE SQL command. The consequences include unexpected table re-creation, disruption of the database schema, potential data loss, and a denial-of-service condition for the memory management service.

Impact

Exploitation of this vulnerability leads to unauthorized memory resets, disruptive table re-creations, potential data loss, and a denial-of-service condition for the memory management service.