Medium severity6.5NVD Advisory· Published Aug 28, 2026

CVE-2026-82273

Description

Mastra through 1.63.0 contains an authentication bypass vulnerability in the memory API thread ownership validation when mapUserToResourceId callback is omitted from configuration. Authenticated attackers can enumerate all threads via GET /api/memory/threads and read conversation history and metadata of other resource owners.

Affected products

Mastra AI/Mastrareferences2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <=1.63.0

Patches

Vulnerability mechanics

References

github.com/mastra-ai/mastra/blob/b7e66f0c478a227985e0062794ef058c3714fabf/packages/server/src/server/handlers/utils.tsnvd
github.com/mastra-ai/mastra/issues/18911nvd
www.vulncheck.com/advisories/mastra-memory-api-thread-ownership-check-is-a-no-op-when-mapusertoresourceid-is-unsetnvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000