CVE-2026-31244

The mem0 1.0.0 server lacks authentication and authorization controls for its memory deletion API endpoint (DELETE /memories/{memory_id}). The endpoint allows unauthenticated users to delete arbitrary memory records without verifying their identity or permissions. A remote attacker can exploit this by sending unauthenticated DELETE requests to remove any memory entry from the database, leading to unauthorized data loss and potential denial of service.

• CWE-306
• CWE-862

• https://github.com/mem0ai/mem0Product
• https://www.notion.so/CVE-2026-31244-35d1e1393188818b8039c50adc75996cMitigation, Third Party Advisory

Published

May 12, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-31239The mamba language model framework thru 2.2.6 is vulnerable …9.8
• CVE-2026-3124The Download Monitor plugin for WordPress is vulnerable to I…7.5
• CVE-2026-31240The mem0 1.0.0 server lacks authentication and authorization…7.5
• CVE-2026-31241The mem0 1.0.0 server lacks authentication and authorization…6.5
• CVE-2026-31242The mem0 v1.0.0 server lacks authentication and authorizatio…9.1
• CVE-2026-31243The mem0 1.0.0 server lacks authentication and authorization…6.5
• CVE-2026-31245The mem0 1.0.0 server lacks authentication and authorization…5.3
• CVE-2026-31246GPT-Pilot thru commit 0819827ce20346ef5f25b3fe29293cb4488405…6.5
• CVE-2026-31247Docling's JATS XML backend is vulnerable to XML Entity Expan…7.5
• CVE-2026-31248Docling's METS GBS backend is vulnerable to XML Entity Expan…7.5
• CVE-2026-31249CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf1…7.3
• CVE-2026-3125A Server-Side Request Forgery (SSRF) vulnerability was ident…6.5