Vulnerability · Published Jun 9, 2026 · Assigned by VulnCheck

CVE-2026-49948Mem0 0.2.8 Missing Authorization via POST /configure Endpoint

High 8.1

In plain English

A high-severity missing authorization in mem0 from mem0ai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.3%top 78.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Mem0 versions through 0.2.8, fixed in commit ae7f406, contain a missing authorization vulnerability in the self-hosted server component where the POST /configure endpoint modifies global LLM provider and embedder configuration but only verifies authentication via JWT or X-API-Key without validating the caller's role. Any authenticated user holding a distributed API key can redirect all LLM and embedder traffic to an attacker-controlled server, with the malicious configuration persisted to PostgreSQL and surviving server restarts to affect all users and API keys on the instance.

Affected products (as reported)

Vendor	Product	Versions
mem0ai	mem0	0 – through 0.2.8

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

https://github.com/mem0ai/mem0/issues/5127 issue-tracking
https://github.com/mem0ai/mem0/issues/5384 issue-tracking
https://github.com/mem0ai/mem0/pull/5360 issue-tracking
https://github.com/mem0ai/mem0/commit/ae7f4062652df1376990221101d1adbb0819c973 patch
https://www.vulncheck.com/advisories/mem0-missing-authorization-via-post-configure-endpoint third-party-advisory