CVE-2026-50027

Name of the Vulnerable Software and Affected Versions mcp-memory-service (affected versions not specified)

Description All HTTP routes under the /api/documents/* endpoint are served without authentication, even when the server is configured with an API key (MCP API KEY) or OAuth. This allows an unauthenticated remote attacker to upload arbitrary content into the memory store, retrieve stored document content, and permanently delete memories belonging to authenticated users. This occurs because the documents.py router is instantiated without authentication dependencies, creating an inconsistent security boundary compared to the /api/memories endpoint which correctly enforces authentication.

Technical details include the following affected endpoints:

Recommendations Add Depends(require write access) or Depends(require read access) to every affected route in documents.py to ensure proper authentication is enforced.