CVE-2026-82273 Mastra Memory API Thread Ownership Check Is a No-op When mapUserToResourceId Is Unset
Authenticated attackers can read other users' conversation history if the mapUserToResourceId callback is omitted from the Mastra memory API configuration.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-82273?
CVE-2026-82273 is a high-severity missing authorization vulnerability in mastra-ai mastra, published on 28 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Mastra through 1.63.0 contains an authentication bypass vulnerability in the memory API thread ownership validation when mapUserToResourceId callback is omitted from configuration. Authenticated attackers can enumerate all threads via GET /api/memory/threads and read conversation history and metadata of other resource owners.
Weakness: CWE-862
Which versions are affected by CVE-2026-82273?
How do I fix CVE-2026-82273?
No fix has been published for CVE-2026-82273 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-82273 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-82273 exists.
Sources
Also known as GHSA-q48c-g8g8-2xq8.