CVE-2026-76236
Received Received - Intake

BOLA Vulnerability in stigmem-node Multi-Tenant Mode

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: VulnCheck

Description
stigmem-node before 0.9.0a12 contains a cross-tenant broken object level authorization (BOLA) flaw in the RTBF (right-to-be-forgotten) tombstone mechanism. issue_tombstone defaulted the tenant to "default" instead of the caller's tenant, allowing deletion records to be written to the wrong tenant, and the read-suppression path (_get_tombstone_filter and the tombstone scope cache) lacked a tenant_id predicate, so tombstone suppression was applied tenant-blind across fact queries and provenance reads. As a result, a tenant's deletion could be attributed to the wrong tenant and tombstone suppression could either hide facts belonging to other tenants or fail to hide facts within the correct tenant, undermining data isolation and RTBF guarantees. The issue is exploitable only on multi-tenant deployments running the opt-in stigmem-plugin-multi-tenant; single-tenant deployments are unaffected. Fixed in 0.9.0a12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-76236
EUVD
EUVD-2026-62476

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
stigmem stigmem-node 0.9.0a12
eidetic_labs stigmem_node 0.9.0a12
eidetic_labs stigmem_plugin_multi_tenant to 0.9.0a12 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-76236 is a cross-tenant broken object level authorization (BOLA) flaw in stigmem-node before 0.9.0a12. It affects the right-to-be-forgotten (RTBF) tombstone mechanism where deletion records are incorrectly assigned to the 'default' tenant instead of the caller's actual tenant. The read-suppression path also lacks tenant isolation, allowing tombstone suppression to be applied across all tenants without proper filtering.

Detection Guidance

Detecting this vulnerability requires checking if stigmem-node versions prior to 0.9.0a12 are running in multi-tenant mode with the stigmem-plugin-multi-tenant plugin enabled. Inspect installed versions and plugin configurations.

Impact Analysis

This vulnerability can lead to data leaks or improper data suppression in multi-tenant deployments. It may cause a tenant's deletion requests to be attributed to another tenant or fail to suppress deleted data within the correct tenant, undermining data isolation and RTBF guarantees.

Compliance Impact

This vulnerability undermines data isolation and RTBF guarantees, which are critical for compliance with GDPR's right to erasure and HIPAA's data integrity requirements. It may lead to unauthorized data exposure or improper data suppression, potentially violating these regulations.

Mitigation Strategies

Upgrade stigmem-node to version 0.9.0a12 or later. This is the only mitigation as no workarounds exist. Ensure multi-tenant deployments are properly configured to propagate tenant IDs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76236. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart