CVE-2026-59705CVSS 9.8 Critical2026-07-08
mem0 openmemory/api Missing Authorization Leading to Data Disclosure and Denial of Service
In the openmemory/api component of mem0, critical API routes do not register authentication middleware, resulting in missing authentication for a critical function (CWE-306). An unauthenticated attacker can reach these exposed endpoints to read, write and delete the memory data of any user. The attacker can supply an arbitrary user_id parameter or access the memory retrieval endpoint directly to expose private memory content, or invoke the pause endpoint with global_pause=true, causing denial of service for all users. The vulnerability affects all mem0 deployments without the patch applied. An attacker can launch the attack remotely without any authentication credentials, directly threatening data confidentiality, integrity and service availability.
Component
mem0 is an open-source memory layer project aiming to provide long-term memory management for AI applications; its openmemory/api component handles memory storage, retrieval and management interfaces.
Risks
- Complete data disclosure: An attacker can read the private memory content of any user, resulting in sensitive information disclosure
- Data tampering and destruction: An attacker can write or delete user memories at will, undermining data integrity
- Denial of service: By triggering the global pause mechanism, an attacker can render the entire service unavailable, affecting all users
- Unauthenticated remote attack: An attacker can exploit the vulnerability directly over the network without any authentication, making the barrier to attack extremely low
Source
Remediation- Enforce authentication middleware at the API gateway or reverse proxy layer so that every route requires verification
- Monitor API access logs to identify and block anomalous unauthenticated requests and global pause operations
CVE-2026-56843CVSS 9.9 Critical2026-07-08
WebPros Plesk XML-RPC API Authorization Bypass Leading to Cross-Tenant Credential Disclosure and Remote Code Execution
In WebPros Plesk prior to version 18.0.78.4, the XML-RPC API contains an authorization error (CWE-522). Because ownership verification is enforced only for some query filters and older protocol versions bypass schema validation, a low-privilege authenticated customer can query domains they do not own. This results in cross-tenant disclosure of other tenants' FTP credentials stored in plaintext, which an attacker can use to execute code as another tenant's system user. The vulnerability affects all Plesk users who have not updated to 18.0.78.4. An attacker only needs a low-privilege account to trigger it, exploiting remotely over the network with no user interaction.
Component
WebPros Plesk is a widely used website and server management panel that simplifies web hosting, mail services and database management.
Risks
- Cross-tenant data disclosure: An attacker can obtain other tenants' plaintext FTP credentials, seriously breaking data isolation in multi-tenant environments
- Remote code execution: Using the disclosed credentials, an attacker can execute arbitrary code as another tenant's system user and fully control the affected tenant's services
- Privilege escalation: From a low-privilege customer account to another tenant's system user privileges, potentially penetrating further into the underlying server
Source
Remediation- Immediately upgrade WebPros Plesk to version 18.0.78.4 or later to fix the authorization logic flaw
- Review and restrict access to the XML-RPC API and disable unnecessary legacy protocol support
- Monitor anomalous domain query behavior and FTP login attempts, and deploy intrusion detection to identify cross-tenant access attempts
