mcp-memory-service: Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Write/Delete

QFinch assessment

All HTTP routes under /api/documents/ in mcp-memory-service are served without any authentication dependency, even when the server is configured with an API key (MCPAPIKEY) or OAuth. An unauthenticated remote attacker can upload arbitrary content into the memory store (write), retrieve stored document content (read), and permanently delete memories belonging to authenticated users (delete) — all without supplying any credentials. The /api/memories counterpart correctly enforces authentication, making this an inconsistent and exploitable authentication boundary. CVSS 9.8 Critical.

Potential impact

This is a Missing Authentication for Critical Function (CWE-306) vulnerability affecting the HTTP REST server component of mcp-memory-service. Who is impacted: Any operator who deploys the HTTP REST server (memory server --http) with MCPAPIKEY or OAuth enabled, expecting that only authenticated clients can access stored memories. The HTTP server is documented as a supported production feature for team/multi-client deployments. Confidentiality: An unauthenticated attacker can read recently uploaded document content via GET /api/documents/search-content/{uploadid} and enumerate upload history via GET /api/documents/history. Stored memories may contain sensitive context such as personal notes, AI agent working state, or proprietary data. Integrity: An unauthenticated attacker can inject arbitrary content into the memory store by uploading documents, polluting the AI agent's knowledge base with attacker-controlled data (memory poisoning / prompt injection surface). Availability: An unauthenticated attacker can delete all memories matching any chosen tags via DELETE /api/documents/remove-by-tags, or delete individual documents via DELETE /api/documents/remove/{uploadid}, causing permanent loss of stored data.

Technical context

The documents.py router is instantiated without any router-level dependencies= parameter and the file does not import Depends at all, so no authentication guard is present on any of its routes: - src/mcpmemoryservice/web/api/documents.py:33 — from fastapi import APIRouter, UploadFile, File, Form, HTTPException, BackgroundTasks (Depends is absent) - src/mcpmemoryservice/web/api/documents.py:43 — router = APIRouter() (no dependencies= argument) The affected endpoints and their data-flow sinks are: | Route | Line (source) | Sink | Line (sink) | |---|---|---|---| | POST /upload | 149 | storage.store(memory) | 449 | | POST /batch-upload | — | storage.store(memory) | — | | GET /history | — | upload metadata response | — | | GET /search-content/{uploadid} | 729 | memory content response | 781 | | DELETE /remove/{uploadid} | — | storage deletion | — | | DELETE /remove-by-tags | 687 | storage.deletebytags(tags) | 705 | The router is mounted in src/mcpmemoryservice/web/app.py:311: No CORSMiddleware or authentication middleware applies to these routes at mount time. By contrast, the equivalent write endpoint in memories.py is correctly protected: This demonstrates that the authentication infrastructure exists and is intentionally applied elsewhere, but was omitted from all documents.py routes.