Authentication Bypass in Mastra via Missing mapUserToResourceId Validation

Executive Summary

Mastra versions up to 1.63.0 have an authentication bypass flaw in the Memory API. When the mapUserToResourceId callback is not configured, the system fails to validate thread ownership properly. This allows authenticated attackers to bypass access controls and enumerate all threads via the GET /api/memory/threads endpoint. They can then read conversation history and metadata of other users without authorization.

Useful 0 Not Useful 0

Detection Guidance

Check if the Mastra server is running and accessible. Use curl to test the vulnerable endpoints: curl -X GET http://<server>/api/memory/threads. If the server returns all threads without authentication checks, the vulnerability is present.

Useful 0 Not Useful 0

Impact Analysis

If you use Mastra with the Memory API and have not configured mapUserToResourceId, attackers with valid credentials could access your private conversations and metadata. They may also see other users' threads, exposing sensitive information like user lists, message histories, and working memory contents. This affects confidentiality of all stored data in the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR's data protection principles by enabling unauthorized access to personal data and HIPAA's requirement for access controls to protect health information. It could lead to data breaches, unauthorized disclosure of sensitive information, and failure to maintain proper access controls, resulting in regulatory penalties and loss of compliance certifications.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Mastra to a version where mapUserToResourceId is properly configured or enable Fine-Grained Authorization (FGA). Ensure the mapUserToResourceId callback is set in authentication setup to enforce resource ownership validation.

Useful 0 Not Useful 0