CVE-2026-82273: Missing Authorization in mastra-ai mastra

CVE-2026-82273 is an authentication bypass vulnerability in mastra-ai's mastra product through version 1.63.0. The issue arises when the mapUserToResourceId callback is omitted from the configuration, causing the memory API's thread ownership validation to be bypassed. Authenticated attackers with limited privileges can exploit this to enumerate all threads via the GET /api/memory/threads endpoint and read conversation history and metadata of other resource owners. The CVSS 4.0 base score is 7.1, indicating a high severity vulnerability with network attack vector, low attack complexity, no user interaction required, and high impact on confidentiality.

Authenticated users with limited privileges can bypass authorization controls to enumerate all threads and access sensitive conversation history and metadata of other users. This compromises confidentiality of user data within the affected mastra versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, ensure the mapUserToResourceId callback is properly configured to enforce thread ownership validation and restrict access accordingly.