CVE-2026-76237highCWE-639

CVE-2026-76237: falha de alta gravidade em eidetic-labs stigmem-node

stigmem before 0.9.0a12 Cross-Tenant BOLA via quarantine

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar stigmem-node+ Monitorar stigmem-node

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.6epss 0.4%
stigmem-node before 0.9.0a12 contains a broken object level authorization (cross-tenant BOLA) vulnerability in the quarantine review endpoints. On multi-tenant deployments running the opt-in stigmem-plugin-multi-tenant, the list/count queries and _get_quarantined_fact in routes/quarantine.py lacked a tenant_id predicate and the garden lookup was not tenant-scoped, allowing a tenant administrator with only a plain tenant write capability to list, read, and admit or reject quarantined facts belonging to other tenants via the /v1/quarantine endpoints. Default single-tenant deployments are not affected.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
eidetic-labs · stigmem-node
CVEs relacionadas — eidetic-labs stigmem-node

No mesmo produto, das mais perigosas para as menos.

CVE-2026-76238HIGHstigmem before 0.9.0a12 Cross-Tenant BOLA via decay sweepEPSS 0.4%CVE-2026-76236HIGHstigmem before 0.9.0a12 Cross-Tenant BOLA via TombstonesEPSS 0.4%CVE-2026-76239MEDIUMStigmem before 0.9.0a11 SSRF via unvalidated webhook delivery_addressEPSS 0.3%