CVE-2026-76237
stigmem before 0.9.0a12 Cross-Tenant BOLA via quarantine
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
stigmem-node before 0.9.0a12 contains a broken object level authorization (cross-tenant BOLA) vulnerability in the quarantine review endpoints. On multi-tenant deployments running the opt-in stigmem-plugin-multi-tenant, the list/count queries and _get_quarantined_fact in routes/quarantine.py lacked a tenant_id predicate and the garden lookup was not tenant-scoped, allowing a tenant administrator with only a plain tenant write capability to list, read, and admit or reject quarantined facts belonging to other tenants via the /v1/quarantine endpoints. Default single-tenant deployments are not affected.
| CWE | CWE-639 |
| Vendor | eidetic-labs |
| Product | stigmem |
| Published | Aug 19, 2026 |
Stay Ahead of the Next One
Get instant alerts for eidetic-labs stigmem
Be the first to know when new unknown vulnerabilities affecting eidetic-labs stigmem are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
eidetic-labs / stigmem
0 < 0.9.0a12