CVE-2026-82273 in Mastra
Summary
by MITRE • 08/28/2026
Mastra through 1.63.0 contains an authentication bypass vulnerability in the memory API thread ownership validation when mapUserToResourceId callback is omitted from configuration. Authenticated attackers can enumerate all threads via GET /api/memory/threads and read conversation history and metadata of other resource owners.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/28/2026
The identified security flaw resides within Mastra versions through 1.63.0, specifically affecting the memory API thread ownership validation mechanism. This vulnerability stems from an incomplete implementation of access control logic when the mapUserToResourceId callback is omitted or not properly configured by the system administrator. In a secure architecture, such callbacks are essential for mapping authenticated user identities to specific resource identifiers, thereby enforcing strict isolation between different users' data contexts. When this configuration step is skipped, the application fails to validate whether the requesting user has legitimate ownership over the requested thread resources, leading to a critical authentication bypass scenario where identity verification is effectively neutralized for memory-related endpoints.
From a technical perspective, the root cause lies in the absence of mandatory resource ownership checks during API request processing. The system allows authenticated users to interact with the GET /api/memory/threads endpoint without verifying that the threads being accessed belong exclusively to their own account or assigned resources. This oversight creates an insecure direct object reference condition where internal thread identifiers can be iterated through by any logged-in user. Since the application does not enforce boundary checks between different resource owners, it exposes sensitive conversation history and metadata associated with other users' interactions. The vulnerability exploits the trust placed in session authentication without validating data-level permissions, a common pattern failure in web applications that handle multi-tenant or shared memory states.
The operational impact of this vulnerability is severe, as it enables authenticated attackers to perform unauthorized enumeration of all threads within the system. By systematically querying the API endpoint, an attacker can harvest conversation histories and metadata belonging to other resource owners. This exposure compromises confidentiality by revealing private communications, potentially including sensitive business information or personal data depending on the application's use case. Furthermore, the availability of metadata may facilitate further attacks such as social engineering or targeted phishing campaigns based on observed interaction patterns. The breach undermines trust in the platform’s security model and violates fundamental principles of data isolation required for compliant handling of user-generated content.
This vulnerability aligns with CWE-284 Improper Access Control and CWE-601 URL Redirection to Untrusted Site if combined with other flaws, but primarily represents a failure in object level authorization checks often categorized under CWE-862 Missing Authorization. In terms of the MITRE ATT&CK framework, this behavior corresponds to T1078 Valid Accounts, as it leverages existing credentials to access unauthorized resources, and potentially T1530 Data from Cloud Storage if the memory backend is cloud-based. To mitigate this risk, developers must ensure that the mapUserToResourceId callback is always defined in the configuration for Mastra deployments up to version 1.63.0. Additionally, implementing strict server-side validation of resource ownership on every API request involving thread data is essential. Upgrading to a patched version where these checks are enforced by default or applying immediate code-level patches that validate user identity against thread ownership before returning any memory-related data will resolve the issue and restore proper access control boundaries.