CVE-2026-49948

The flaw

Mem0 versions through 0.2.8, fixed in commit ae7f406, contain a missing authorization vulnerability in the self-hosted server component where the POST /configure endpoint modifies global LLM provider and embedder configuration but only veri

What to do

Review advisory and patch per vendor guidance.

References