CVE-2026-31240 describes a security vulnerability in the mem0 1.0.0 server where critical API endpoints for memory management do not enforce authentication or authorization. Specifically, the PUT /memories/{memory_id} endpoint can be accessed by unauthenticated remote attackers, allowing them to manipulate memory records arbitrarily. This lack of access control exposes the system to unauthorized data manipulation and potential data loss. No CVSS score or vendor advisory is available, and no patch or mitigation has been confirmed.

An attacker can remotely exploit this vulnerability to modify, overwrite, or delete memory records without any authentication or permission checks. This can lead to unauthorized data manipulation and potential data loss within the affected system. There is no evidence of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the mem0 server’s API endpoints to trusted users only and monitor for unauthorized access attempts. Implement external access controls or network segmentation as a temporary measure to reduce exposure.