CVE-2026-76238: Incorrect Authorization in eidetic-labs stigmem-node

CVE-2026-76238 describes a broken object level authorization vulnerability in eidetic-labs stigmem-node versions prior to 0.9.0a12. The flaw exists in the decay sweep endpoint, where authenticated attackers with write credentials for a single tenant can submit POST requests with ttl_seconds=0 to expire facts across all tenants or use the dry_run parameter to obtain cross-tenant fact counts and existence information. This allows unauthorized cross-tenant operations and information leakage.

An attacker with write privileges on one tenant can cause data expiration across all tenants, potentially disrupting data integrity and availability for other tenants. Additionally, the attacker can gather information about facts in other tenants, leading to unauthorized information disclosure. The CVSS 4.0 score of 7.2 indicates a high severity impact with network attack vector, low attack complexity, and no user interaction required.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict write access to trusted users only and monitor for suspicious decay sweep endpoint usage.