Dashboard / CVE-2026-49948

CVE-2026-49948

HIGH
MEDIUM Priority: 0.02 BB Relevance: 67/100
Published: 2026-06-09 Modified: 2026-11-08 First seen: 2026-11-08 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
AT: None
VC: High
VI: High
VA: None

Description

Mem0 versions through 0.2.8, fixed in commit ae7f406, contain a missing authorization vulnerability in the self-hosted server component where the POST /configure endpoint modifies global LLM provider and embedder configuration but only verifies authentication via JWT or X-API-Key without validating the caller's role. Any authenticated user holding a distributed API key can redirect all LLM and embedder traffic to an attacker-controlled server, with the malicious configuration persisted to PostgreSQL and surviving server restarts to affect all users and API keys on the instance.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
mem0ai mem0 0

References & Advisories (5)

Bug Bounty Relevance

67 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

8.6 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.29%
Raw Score 0.002900
Percentile 21.8%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00290
2026-11-12
0.00290
2026-11-10
0.00290
2026-11-09
0.00290
2026-11-08
0.00290

Intelligence Sources

mitre ref →

External Links