CVE-2026-76236: Authorization Bypass Through User-Controlled Key in eidetic-labs stigmem-node

CVE-2026-76236 is a broken object level authorization vulnerability in eidetic-labs stigmem-node prior to version 0.9.0a12. The flaw exists in the RTBF tombstone mechanism where the tenant context defaults incorrectly to "default" instead of the caller's tenant when issuing tombstones. Additionally, the tombstone read-suppression logic lacks tenant_id predicates, causing tombstone suppression to be applied tenant-blind across fact queries and provenance reads. This results in deletion records being attributed to the wrong tenant and suppression either hiding facts from other tenants or failing to hide facts within the correct tenant. The vulnerability only affects multi-tenant deployments running the stigmem-plugin-multi-tenant and is fixed in 0.9.0a12.

The vulnerability undermines tenant data isolation and the right-to-be-forgotten guarantees by allowing deletion records and tombstone suppression to cross tenant boundaries. This can cause deletion records to be misattributed and facts to be improperly hidden or exposed across tenants. Single-tenant deployments are not affected. The CVSS 4.0 score is 7.2 (high severity), indicating a significant risk if exploited.

Upgrade stigmem-node to version 0.9.0a12 or later, where this authorization bypass vulnerability is fixed. No additional mitigations are indicated by the vendor advisory. Single-tenant deployments are not affected.