CVE-2026-82273
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
Mastra through 1.63.0 contains an authentication bypass vulnerability in the memory API thread ownership validation when mapUserToResourceId callback is omitted from configuration. Authenticated attackers can enumerate all threads via GET /api/memory/threads and read conversation history and metadata of other resource owners.
Risk Assessment
An attacker could access private conversations and metadata of other users, potentially leading to privacy breach and data leakage.
Recommendation
Update Mastra to a version that fixes ownership validation. Ensure the mapUserToResourceId callback is always configured.
Other vulnerabilities in Mastra
Original NVD description (English source)
Mastra through 1.63.0 contains an authentication bypass vulnerability in the memory API thread ownership validation when mapUserToResourceId callback is omitted from configuration. Authenticated attackers can enumerate all threads via GET /api/memory/threads and read conversation history and metadata of other resource owners.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS