CVE-2026-59705 Details

A vulnerability exists in the OpenMemory API component of Mem0, allowing unauthenticated users to read, write, and delete any user's private memories. This issue arises because all API routers are registered without authentication middleware, enabling cross-user memory access. Attackers can exploit this by supplying arbitrary user_id parameters or directly accessing memory retrieval endpoints. Additionally, the vulnerability allows for a denial-of-service condition across all users by invoking pause endpoints with global_pause=true.

It is recommended to add authentication requirements to all API routers in the OpenMemory component and implement ownership checks in the memory handling endpoints to ensure that only authorized users can access or modify their own memory data.