CVE-2026-82273

Mastra through 1.63.0 contains a missing-authorization flaw (CWE-862) in the memory API's thread ownership validation, which is bypassed when deployments omit the mapUserToResourceId callback from their memory configuration. An attacker with valid credentials can exploit it by sending GET /api/memory/threads to a Mastra server, enumerating every stored thread rather than only their own. As a result, the attacker can read conversation history and metadata belonging to other resource owners, a high-confidentiality information disclosure with no integrity or availability impact (CVSS 4.0: 7.1 High). Any deployment running Mastra at version 1.63.0 or earlier that exposes the memory API to authenticated, multi-resource users without the callback configured is affected. No public proof-of-concept, KEV listing, or confirmed in-the-wild exploitation is known, and EPSS currently estimates only a 0.3% probability of exploitation within 30 days.

What to do: Upgrade Mastra to the first patched release after 1.63.0 (the fixed version is not specified in the available data). As a workaround, configure the mapUserToResourceId callback in the memory settings so per-resource thread ownership is enforced, and restrict network access to /api/memory/threads. Check server logs for authenticated users enumerating or reading threads they do not own.