Mastra
Monthly
Cross-user thread enumeration in the Mastra AI framework through version 1.63.0 allows authenticated low-privilege attackers to read conversation histories and metadata belonging to other resource owners via the memory API. The ownership validation in GET /api/memory/threads is silently disabled when the `mapUserToResourceId` callback is omitted from server configuration, creating a no-op authorization gate (CWE-862). No public exploit code or CISA KEV listing exists, but the CVSS 4.0 score of 7.1 reflects the high confidentiality impact achievable with only a valid authenticated session.
Cross-user thread enumeration in the Mastra AI framework through version 1.63.0 allows authenticated low-privilege attackers to read conversation histories and metadata belonging to other resource owners via the memory API. The ownership validation in GET /api/memory/threads is silently disabled when the `mapUserToResourceId` callback is omitted from server configuration, creating a no-op authorization gate (CWE-862). No public exploit code or CISA KEV listing exists, but the CVSS 4.0 score of 7.1 reflects the high confidentiality impact achievable with only a valid authenticated session.