CVE-2024-39025: Letta (previously MemGPT) incorrect access control vulnerability

The vulnerability stems from the GET /users endpoint implementation in users.py. The get_all_users function (lines 55-68 in the shown code) directly accesses user data through server.ms.get_all_users() without any authentication/authorization checks. This matches the CWE-863 description of missing authorization controls. The Medium article specifically calls out this endpoint's lack of access controls, and the code shows no middleware or decorators enforcing privileges. The high confidence comes from direct correlation between the advisory description, CWE classification, and the observed code implementation.