{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"0.3.17"}],"component":"letta","cve_ids":["CVE-2024-39025"],"ecosystem":"PyPI","epss":0.00405,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-7p2g-2vxc-5g55","id":"tcs_01M5KF6ABGFDPJGEY9NV5TP4VA","modified_at":"2026-07-07T17:57:07.015070989Z","published_at":"2024-12-27T21:30:30Z","references":["https://osv.dev/vulnerability/GHSA-7p2g-2vxc-5g55","https://nvd.nist.gov/vuln/detail/CVE-2024-39025","https://github.com/letta-ai/letta","https://github.com/letta-ai/letta/blob/0.3.17/memgpt/server/rest_api/admin/users.py#L55-L68","https://github.com/letta-ai/letta/releases/tag/0.3.17","https://medium.com/@cnetsec/a-vulnerability-cve-2024-39025-has-been-identified-in-lettaai-memgpt-v0-3-17-146cb38bb6db"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-7p2g-2vxc-5g55","url":"https://osv.dev/vulnerability/GHSA-7p2g-2vxc-5g55"}],"summary":"Letta (previously MemGPT) incorrect access control vulnerability"}