CVE-2026-76243 is an improper authorization vulnerability in eidetic-labs stigmem affecting versions before 0.9.0a2. When authentication is disabled on deployments that are not limited to the loopback interface, unauthenticated users can access the system and perform read, write, and federation operations with an anonymous identity. This issue arises because the software does not enforce authentication properly in these deployment scenarios, potentially exposing sensitive operations to unauthorized parties.

Attackers can gain unauthorized access to stigmem nodes exposed outside local development environments, allowing them to read, modify, and federate data without authentication. This could lead to data leakage, unauthorized data manipulation, and compromise of federated operations. The vulnerability is rated critical with a CVSS 4.0 score of 9.2, indicating high impact and exploitability over the network without user interaction or privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid disabling authentication on non-loopback deployments and restrict stigmem nodes to local development environments only. Monitor vendor communications for updates on patches or official mitigations.