CVE-2026-59705 describes a critical unauthenticated access vulnerability in the mem0 openmemory/api component. The API routers are registered without authentication middleware, allowing attackers to perform unauthorized read, write, and delete operations on user memories. Attackers can supply arbitrary user_id parameters or directly access memory retrieval endpoints to expose private memory content. Furthermore, attackers can trigger a denial-of-service by invoking pause endpoints with a global_pause=true parameter, affecting all users. The vulnerability is classified under CWE-306 (Missing Authentication for Critical Function). No patch or remediation information is currently available.

This vulnerability allows unauthenticated attackers to fully compromise user memory data by reading, modifying, or deleting it. It also enables denial-of-service attacks affecting all users by globally pausing the service. The lack of authentication on critical API endpoints leads to a complete breach of confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected API endpoints through network controls or implement external authentication proxies to prevent unauthenticated access.