Mastra Memory API Cross-Resource Thread Enumeration (Unset mapUserToResource)

Vulnerability Summary: Cross-Resource Thread Enumeration via Memory API (When mapUserToResource is Not Configured) Overview Type: When authentication is enabled and is not configured, the ownership checks in the Memory HTTP routes are entirely skipped. Root Cause: is an optional value; when it is , both the and are bypassed, allowing any authenticated user to read and interact with arbitrary threads. Severity: High — In multi-user scenarios, threads can be enumerated across users ( returns all threads). Affected Areas Affected Routes: - - - - Affected Files and Line Numbers: - lines 73-79 ( ), lines 98-105 ( ) - lines 812-836 ( filter) Impact: - Any authenticated user can enumerate all threads (including , , and ). - Full content of any thread (including messages) can be read without providing a . - When is correctly configured, is set, the ownership check takes effect, and the vulnerability is not triggered. POC / Exploit Code Remediation 1. Remove the optionality of : In lines 128-134, when authentication is enabled and is not configured, an error should be thrown rather than silently skipping the check. 2. Mandate resource scoping: When authentication is enabled, must be configured; otherwise, startup should fail. 3. Fix : When no valid resource ID is present, access should be denied rather than allowed (maintaining shared thread semantics). 4. Keep as an optional configuration: In and , explicitly state that it is required when authentication is enabled. 5. For end-user workflows: Configure , or implement and to enforce resource scoping at the memory boundary. References Minimal reproducible example: Enterprise boundary:

Goal Reached Thanks to every supporter — we hit 100%!

Mastra Memory API Cross-Resource Thread Enumeration (Unset mapUserToResource)

More from this source