CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-59705 — mem0's openmemory/api component contains an unauthenticated access vulnerability...

·Source: NIST NVD

Updated:

Executive Summary

mem0's openmemory/api component contains an unauthenticated access vulnerability that allows unauthenticated attackers to read, write, and delete arbitrary user memories by accessing API routers registered without authentication middleware. Attackers can supply arbitrary user_id parameters or directly access memory retrieval endpoints to expose private memory content, or invoke pause endpoints wit

Analysis

mem0's openmemory/api component contains an unauthenticated access vulnerability that allows unauthenticated attackers to read, write, and delete arbitrary user memories by accessing API routers registered without authentication middleware. Attackers can supply arbitrary user_id parameters or directly access memory retrieval endpoints to expose private memory content, or invoke pause endpoints with global_pause=true to cause denial-of-service across all users. CVSS Score: 9.8. Published: 2026-07-07T23:16:55.997.

Indicators of Compromise (1)

CVE (1)
CVE-2026-59705
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jul 7, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

NatWest Boxed and Mettle CTO Wayne Freeman leaves

The chief technology officer of NatWest's Boxed Banking-as-a-Service unit and its Mettle digital account for UK small businesses has stepped down.

Finextra
MEDIUMVulnerability

Italian fintech Satispay partners Mastercard for debit card launch

Italian fintech unicorn Satispay has taken another step towards building out its "superapp" by joining forces with Mastercard to launch debit cards and adding the ability to invest in stocks and ETFs.

Finextra
HIGHVulnerability

NVD HIGH: CVE-2026-59704 — Cap's GET /api/video/ai endpoint fails to validate user ownership or membership ...

Cap's GET /api/video/ai endpoint fails to validate user ownership or membership before returning private video AI metadata including titles, summaries, and chapters. Authenticated attackers can supply arbitrary video IDs to read sensitive AI-generated content and trigger unauthorized AI generation that consumes the video owner's credits without consent.

CVE-2026-59704
NIST NVD