CVE-2026-54519

CVE-2026-54519 ai-agent-automation에서 메모리 API에 소유권 검사가 누락되어 교차 사용자 메모리 읽기 및 삭제가 가능했습니다. 기본 권고: GHSA-qv97-83w4-ff86 연구자 크레딧: @chaitanyagarware 한눈에 보기 필드| 값 ---|--- CVE| CVE-2026-54519 GHSA| GHSA-qv97-83w4-ff86 프로젝트| vmDeshpande/ai-agent-automation 패키지| backend 생태계| npm 심각도| 높음 CVSS| 8.8,...

CVE-2026-82283

VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers, allowing authenticated users to access other users' conversations. Attackers can read, modify, and delete arbitrary conversations and messages by supplying caller-controlled identifiers to memory endpoints...

CVE-2026-82273

Mastra through 1.63.0 contains an authentication bypass vulnerability in the memory API thread ownership validation when mapUserToResourceId callback is omitted from configuration. Authenticated attackers can enumerate all threads via GET /api/memory/threads and read conversation history and...

EUVD-2026-67814

VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers, allowing authenticated users to access other users' conversations. Attackers can read, modify, and delete arbitrary conversations and messages by supplying caller-controlled identifiers to memory endpoints...

CVE-2026-82283

VoltAgent through 2.1.20 contains an authorization flaw in its memory API handlers , which fail to validate conversation ownership . An authenticated attacker can supply caller-controlled identifiers to memory endpoints to read, modify, or delete conversations and messages belonging to other user...

CVE-2026-82283 VoltAgent Memory API Handlers Missing Ownership Checks

VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers, allowing authenticated users to access other users' conversations. Attackers can read, modify, and delete arbitrary conversations and messages by supplying caller-controlled identifiers to memory endpoints...

CVE-2026-82283 VoltAgent Memory API Handlers Missing Ownership Checks

VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers, allowing authenticated users to access other users' conversations. Attackers can read, modify, and delete arbitrary conversations and messages by supplying caller-controlled identifiers to memory endpoints...

CVE-2026-82283 VoltAgent Memory API Handlers Missing Ownership Checks

VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers, allowing authenticated users to access other users' conversations. Attackers can read, modify, and delete arbitrary conversations and messages by supplying caller-controlled identifiers to memory endpoints...

CVE-2026-82273 Mastra Memory API Thread Ownership Check Is a No-op When mapUserToResourceId Is Unset

Mastra through 1.63.0 contains an authentication bypass vulnerability in the memory API thread ownership validation when mapUserToResourceId callback is omitted from configuration. Authenticated attackers can enumerate all threads via GET /api/memory/threads and read conversation history and...

CVE-2026-82273

Mastra through 1.63.0 contains an authentication bypass in the memory API thread ownership validation. When the mapUserToResourceId callback is omitted from configuration, the ownership check becomes a no-op, allowing any authenticated user to enumerate all threads via GET /api/memory/threads and...

CVE-2026-82273 Mastra Memory API Thread Ownership Check Is a No-op When mapUserToResourceId Is Unset

Mastra through 1.63.0 contains an authentication bypass vulnerability in the memory API thread ownership validation when mapUserToResourceId callback is omitted from configuration. Authenticated attackers can enumerate all threads via GET /api/memory/threads and read conversation history and...

CVE-2026-82273 Mastra Memory API Thread Ownership Check Is a No-op When mapUserToResourceId Is Unset

Mastra through 1.63.0 contains an authentication bypass vulnerability in the memory API thread ownership validation when mapUserToResourceId callback is omitted from configuration. Authenticated attackers can enumerate all threads via GET /api/memory/threads and read conversation history and...

EUVD-2026-67804

Mastra through 1.63.0 contains an authentication bypass vulnerability in the memory API thread ownership validation when mapUserToResourceId callback is omitted from configuration. Authenticated attackers can enumerate all threads via GET /api/memory/threads and read conversation history and...

CVE-2026-82283: Authorization Bypass Through User-Controlled Key

VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers, allowing authenticated users to access other users' conversations. Attackers can read, modify, and delete arbitrary conversations and messages by supplying caller-controlled identifiers to memory endpoints...

PT-2026-83296

Mastra through 1.63.0 contains an authentication bypass vulnerability in the memory API thread ownership validation when mapUserToResourceId callback is omitted from configuration. Authenticated attackers can enumerate all threads via GET /api/memory/threads and read conversation history and...

PT-2026-83306

VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers, allowing authenticated users to access other users' conversations. Attackers can read, modify, and delete arbitrary conversations and messages by supplying caller-controlled identifiers to memory endpoints...

EUVD-2026-40008

A vulnerability was determined in VoltAgent up to 2.1.17. Affected by this issue is the function handleGetMemoryConversation of the file packages/server-core/src/handlers/memory.handlers.ts of the component Memory REST API. Executing a manipulation of the argument conversationId can lead to...

CVE-2026-13511

A vulnerability was determined in VoltAgent up to 2.1.17. Affected by this issue is the function handleGetMemoryConversation of the file packages/server-core/src/handlers/memory.handlers.ts of the component Memory REST API. Executing a manipulation of the argument conversationId can lead to...

CVE-2026-13511 VoltAgent Memory REST API memory.handlers.ts handleGetMemoryConversation improper authorization

A vulnerability was determined in VoltAgent up to 2.1.17. Affected by this issue is the function handleGetMemoryConversation of the file packages/server-core/src/handlers/memory.handlers.ts of the component Memory REST API. Executing a manipulation of the argument conversationId can lead to...

CVE-2026-13511 VoltAgent Memory REST API memory.handlers.ts handleGetMemoryConversation improper authorization

A vulnerability was determined in VoltAgent up to 2.1.17. Affected by this issue is the function handleGetMemoryConversation of the file packages/server-core/src/handlers/memory.handlers.ts of the component Memory REST API. Executing a manipulation of the argument conversationId can lead to...