An unauthenticated remote attacker can read, write, or delete sensitive document data due to a critical authentication bypass in the mcp-memory-service package.

All HTTP routes under /api/documents/* lack necessary authentication checks, despite server-side configurations for API keys or OAuth. This permits unauthenticated remote users to perform arbitrary operations, including content modification and deletion, on the memory store.

The lack of authentication on critical document routes poses a severe risk to data integrity and confidentiality. With a CVSS score of 9.8, this vulnerability allows unauthorized actors to manipulate or destroy AI memory stores, potentially leading to data loss or the injection of malicious information into AI workflows. The inconsistency in the authentication boundary significantly lowers the barrier for exploitation.

Immediate Action: Update the mcp-memory-service package to version 10.67.1 or later to enforce mandatory authentication across all API routes.

Proactive Monitoring: Monitor API access logs for anomalous requests to the /api/documents/ endpoint, particularly from unexpected IP addresses. Audit existing memory stores for signs of unauthorized modifications or deletions.

Compensating Controls: Deploy a Web Application Firewall (WAF) to restrict access to the /api/documents/ path until the patch can be applied. Ensure the service is not exposed to the public internet without additional authentication layers.

Public Exploit Available: Unknown

This vulnerability represents a significant security failure in the software's access control design. Administrators must prioritize the update to version 10.67.1 to restore secure access controls and protect the integrity of the stored data.