CVE-2026-76237: Authorization Bypass Through User-Controlled Key in eidetic-labs stigmem-node
Description
stigmem-node versions before 0.9.0a12 contain an authorization bypass vulnerability affecting multi-tenant deployments using the stigmem-plugin-multi-tenant. This flaw allows a tenant administrator with write access to their own tenant to access and manipulate quarantined facts of other tenants via the /v1/quarantine endpoints. Single-tenant deployments are not affected.
CVSS v4.0
Score 8.6high
Affected software
eidetic-labs
stigmem-node
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-76237 is a broken object level authorization vulnerability (cross-tenant BOLA) in stigmem-node prior to version 0.9.0a12. The issue exists in the quarantine review endpoints where list/count queries and the _get_quarantined_fact function in routes/quarantine.py do not enforce tenant_id predicates, and the garden lookup is not scoped by tenant. This allows a tenant administrator with write privileges limited to their own tenant to list, read, admit, or reject quarantined facts belonging to other tenants in multi-tenant environments running the opt-in stigmem-plugin-multi-tenant. Default single-tenant deployments are not vulnerable.
Potential Impact
An attacker with tenant write privileges in a multi-tenant stigmem-node deployment can bypass authorization controls to access and modify quarantined facts of other tenants. This compromises tenant data isolation and confidentiality within the multi-tenant environment. The vulnerability does not affect single-tenant deployments.
Mitigation Recommendations
No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using stigmem-plugin-multi-tenant in multi-tenant deployments or restrict tenant administrator privileges to trusted users only.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-19T11:38:33.224Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a85bc7eacd9273b492f4a0e
Added to database: 08/19/2026, 14:23:58 UTC
Last enriched: 09/11/2026, 08:33:32 UTC
Last updated: 10/04/2026, 10:02:29 UTC
Views: 48
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.