Broken Object Level Authorization in Stigmem Prior to 0.9.0a12

Executive Summary

CVE-2026-76238 is a Broken Object Level Authorization (BOLA) vulnerability in stigmem versions before 0.9.0a12. It allows authenticated attackers with write credentials for one tenant to perform decay operations affecting all tenants. Attackers can submit POST requests to the decay sweep endpoint with ttl_seconds=0 to expire facts across all tenants or use dry_run to obtain cross-tenant fact counts and existence information.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your stigmem version is below 0.9.0a12. Run stigmem --version or inspect package metadata. Verify if multi-tenant mode is enabled by checking stigmem-plugin-multi-tenant configuration. Monitor API logs for POST requests to the decay sweep endpoint (/api/decay/sweep) with ttl_seconds=0 or dry_run=true from non-admin users.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to data destruction affecting integrity and availability by expiring facts across all tenants. It also allows information disclosure by revealing cross-tenant fact counts and existence. The impact is limited to multi-tenant deployments; single-tenant setups are unaffected.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can violate compliance requirements by enabling unauthorized access to tenant data across all tenants, potentially breaching confidentiality and integrity. It may lead to data destruction or unauthorized information disclosure, which could result in non-compliance with GDPR, HIPAA, or other regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade stigmem to version 0.9.0a12 or later. Disable multi-tenant mode if not required. Restrict write credentials to the minimum necessary. Monitor for suspicious POST requests to the decay sweep endpoint. Apply network-level controls to limit access to the endpoint.

Useful 0 Not Useful 0