CVE-2026-76237
Received Received - Intake

Broken Object Level Authorization in stigmem-node

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: VulnCheck

Description
stigmem-node before 0.9.0a12 contains a broken object level authorization (cross-tenant BOLA) vulnerability in the quarantine review endpoints. On multi-tenant deployments running the opt-in stigmem-plugin-multi-tenant, the list/count queries and _get_quarantined_fact in routes/quarantine.py lacked a tenant_id predicate and the garden lookup was not tenant-scoped, allowing a tenant administrator with only a plain tenant write capability to list, read, and admit or reject quarantined facts belonging to other tenants via the /v1/quarantine endpoints. Default single-tenant deployments are not affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-76237
EUVD
EUVD-2026-62477

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
stigmem stigmem-node to 0.9.0a12 (exc)
stigmem stigmem-plugin-multi-tenant *
eidetic_labs stigmem_node to 0.9.0a12 (exc)
eidetic_labs stigmem_plugin_multi_tenant to 0.9.0a12 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Broken Object Level Authorization (BOLA) vulnerability in stigmem-node before version 0.9.0a12. It affects multi-tenant deployments using the stigmem-plugin-multi-tenant plugin. The issue allows a tenant administrator to list, read, and modify quarantined facts belonging to other tenants via the /v1/quarantine endpoints due to missing tenant_id filtering in queries and tenant-scoped garden lookups.

Detection Guidance

Check if your stigmem-node version is below 0.9.0a12 and if the stigmem-plugin-multi-tenant is enabled. Inspect network traffic for unauthorized access to /v1/quarantine endpoints by tenant administrators.

Impact Analysis

An attacker with tenant administrator privileges could access, list, read, or modify quarantined data belonging to other tenants. This violates cross-tenant isolation, potentially exposing sensitive information or altering data integrity. Single-tenant deployments are not affected.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality and integrity requirements in GDPR and HIPAA. It may result in non-compliance due to insufficient data isolation between tenants, potentially leading to data breaches and regulatory penalties.

Mitigation Strategies

Upgrade stigmem-node to version 0.9.0a12 or later. Disable the stigmem-plugin-multi-tenant if multi-tenant isolation is not required. Monitor quarantine endpoints for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76237. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart