CVE-2026-82273CWE-862broken-access-control

CVE-2026-82273

Medium · published August 29, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
31.3
In the wild
Unconfirmed
What it is

Mastra through 1.63.0 contains an authentication bypass vulnerability in the memory API thread ownership validation when mapUserToResourceId callback is omitted from configuration. Authenticated attackers can enumerate all threads via GET /api/memory/threads and read conversation history and metadata of other resource owners.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00384 · 31.3th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-08-29T00:20Z
References (5)
https://github.com/mastra-ai/mastra · [email protected]https://github.com/mastra-ai/mastra/blob/b7e66f0c478a227985e0062794ef058c3714fabf/packages/server/src/server/handlers/utils.ts · [email protected]https://github.com/mastra-ai/mastra/issues/18911 · [email protected]https://www.vulncheck.com/advisories/mastra-memory-api-thread-ownership-check-is-a-no-op-when-mapusertoresourceid-is-unset · [email protected]https://github.com/mastra-ai/mastra/issues/18911 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 30 AUG 16:19Z
    EPSS moved — → 0%
    epss
  • 28 AUG 16:18Z
    Mastra Memory API Thread Ownership Check Is a No-op When mapUserToResourceId Is Unset
    cvelistv5