CVE-2026-82273: Mastra Memory API Thread Ownership Check Is a No-op When mapUserToResourceId Is Unset
Mastra through 1.63.0 contains an authentication bypass vulnerability in the memory API thread ownership validation when mapUserToResourceId callback is omitted from configuration. Authenticated attackers can enumerate all threads via GET /api/memory/threads and read conversation history and metadata of other resource owners.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mastrato a version that resolves this vulnerability.Fixed in 1.63.0 - Configuration
Ensure the mapUserToResourceId callback is set in configuration so Mastra memory API thread ownership validation is not a no-op.
Mastra Memory API mapUserToResourceId callback = configured (not omitted)
Event History
Frequently Asked Questions
Who is exposed to this issue?
Mastra Memory API deployments through 1.63.0 are exposed when the mapUserToResourceId callback is omitted from configuration. The affected endpoint is GET /api/memory/threads.
What does an attacker need to exploit it?
An attacker needs to be authenticated with low-level privileges. No user interaction is required, and the issue is reachable over the network.
What data could be exposed?
An authenticated attacker can enumerate all threads and read conversation histories and metadata belonging to other resource owners.