Vulnerability · Published Aug 28, 2026 · Assigned by VulnCheck
CVE-2026-82273Mastra Memory API Thread Ownership Check Is a No-op When mapUserToResourceId Is Unset
Medium 6.5
In plain English
A medium-severity missing authorization in mastra from mastra-ai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.5%top 54.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Mastra through 1.63.0 contains an authentication bypass vulnerability in the memory API thread ownership validation when mapUserToResourceId callback is omitted from configuration. Authenticated attackers can enumerate all threads via GET /api/memory/threads and read conversation history and metadata of other resource owners.
Affected products (as reported)
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- GitHub Issue #18911 issue-tracking
- https://github.com/mastra-ai/mastra product
- Vulnerable code: utils.ts technical-description
- VulnCheck Advisory: Mastra Memory API Thread Ownership Check Is a No-op When mapUserToResourceId Is Unset third-party-advisory