CVE-2026-76238highCWE-863

CVE-2026-76238: high-severity vulnerability in eidetic-labs stigmem-node

stigmem before 0.9.0a12 Cross-Tenant BOLA via decay sweep

Published · Updated

Follow this CVE+ Monitor stigmem-node+ Monitor stigmem-node

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.2epss 0.4%
stigmem versions before 0.9.0a12 contain a broken object level authorization vulnerability in the decay sweep endpoint that allows authenticated attackers with write credentials for one tenant to execute decay operations affecting all tenants. Attackers can submit POST requests to the decay sweep endpoint with ttl_seconds=0 to expire facts across all tenants, or use dry_run to obtain cross-tenant fact counts and existence information.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
eidetic-labs · stigmem-node
Related CVEs — eidetic-labs stigmem-node

In the same product, most dangerous first.

CVE-2026-76237HIGHstigmem before 0.9.0a12 Cross-Tenant BOLA via quarantineEPSS 0.4%CVE-2026-76236HIGHstigmem before 0.9.0a12 Cross-Tenant BOLA via TombstonesEPSS 0.4%CVE-2026-76239MEDIUMStigmem before 0.9.0a11 SSRF via unvalidated webhook delivery_addressEPSS 0.3%