CyberRota Analysis
AI-GeneratedThe vulnerability allows authenticated attackers to bypass authentication mechanisms in Mastra versions up to 1.63.0 by omitting the mapUserToResourceId callback from configuration, enabling them to enumerate threads and access sensitive conversation history and metadata of other users. Organizations using this software should prioritize patching or reconfiguring their systems to mitigate the risk of unauthorized data exposure. This issue is particularly relevant for environments where sensitive information is handled and user privacy is a concern.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Mastra through 1.63.0 contains an authentication bypass vulnerability in the memory API thread ownership validation when mapUserToResourceId callback is omitted from configuration. Authenticated attackers can enumerate all threads via GET /api/memory/threads and read conversation history and metadata of other resource owners.