The mem0 1.0.0 server exposes its memory management API endpoints, including the PUT /memories/{memory_id} function, without any authentication or authorization mechanisms. This absence of access control enables remote attackers to perform unauthorized modifications to memory records, potentially resulting in data integrity issues. The vulnerability is identified as CWE-306 (Missing Authentication for Critical Function). The CVSS v3.1 base score is 7.5, reflecting high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to integrity loss without confidentiality or availability impact. No patch or official fix has been published, and no known exploits are reported in the wild.

Exploitation of this vulnerability allows an unauthenticated remote attacker to modify, overwrite, or delete arbitrary memory records on the mem0 1.0.0 server. This leads to unauthorized data manipulation and potential data loss, impacting the integrity of the system's memory data. There is no direct impact on confidentiality or availability according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the mem0 server's memory management API endpoints to trusted users only. Implement external access controls such as network segmentation or firewall rules to limit exposure. Monitor for unusual activity related to memory record modifications. Avoid exposing these endpoints to untrusted networks.