CVE-2026-49948

HIGH SEVERITY

CVSS Score & Metrics

Base Score

8.1 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N                                    

Vulnerability Description

Mem0 versions through 0.2.8, fixed in commit ae7f406, contain a missing authorization vulnerability in the self-hosted server component where the POST /configure endpoint modifies global LLM provider and embedder configuration but only verifies authentication via JWT or X-API-Key without validating the caller's role. Any authenticated user holding a distributed API key can redirect all LLM and embedder traffic to an attacker-controlled server, with the malicious configuration persisted to PostgreSQL and surviving server restarts to affect all users and API keys on the instance.

Vulnerability Details

Published Date

June 09, 2026

Last Modified

June 09, 2026

CWE ID

CWE-862

Source

NVD

Vendor

mem0ai

Product

mem0

External References

https://github.com/mem0ai/mem0/commit/ae7f4062652df1376990221101d1adbb0819c973
https://github.com/mem0ai/mem0/issues/5127
https://github.com/mem0ai/mem0/issues/5384
https://github.com/mem0ai/mem0/pull/5360
https://www.vulncheck.com/advisories/mem0-missing-authorization-via-post-configure-endpoint

CVE-2026-49948

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment