The mem0 1.0.0 server exposes a memory deletion API endpoint that does not enforce authentication or authorization, enabling unauthenticated users to delete any memory record by sending DELETE requests to /memories/{memory_id}. This vulnerability corresponds to CWE-306 (Missing Authentication for Critical Function) and CWE-862 (Missing Authorization). The lack of access controls can lead to unauthorized data deletion and denial of service conditions. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and high availability impact. There is no vendor advisory or patch information available at this time.

An attacker can remotely delete arbitrary memory records without authentication, causing unauthorized data loss and potentially disrupting service availability. There is no confidentiality impact reported. The integrity of data is impacted at a low level, while availability impact is high due to possible denial of service from data deletion.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable API endpoint through network controls such as firewalls or API gateways to prevent unauthenticated access. Monitor for unusual deletion activity and consider implementing compensating controls like authentication proxies or rate limiting to reduce risk.