CVE Feed

    Dashboard / CVE / CVE-2026-76236

    CVE-2026-76236

    stigmem-node before 0.9.0a12 contains a cross-tenant broken object level authorization (BOLA) flaw in the RTBF (right-to-be-forgotten) tombstone mechanism. issue_tombstone defaulted the tenant to "default" instead of the caller's tenant, allowing deletion records to be written to the wrong tenant, and the read-suppression path (_get_tombstone_filter and the tombstone scope cache) lacked a tenant_id predicate, so tombstone suppression was applied tenant-blind across fact queries and provenance reads. As a result, a tenant's deletion could be attributed to the wrong tenant and tombstone suppression could either hide facts belonging to other tenants or fail to hide facts within the correct tenant, undermining data isolation and RTBF guarantees. The issue is exploitable only on multi-tenant deployments running the opt-in stigmem-plugin-multi-tenant; single-tenant deployments are unaffected. Fixed in 0.9.0a12.

    Published:Aug 19, 2026
    Last Modified:Aug 21, 2026
    EPS:Aug 19, 2026
    EPSS Score:0.00265
    CVSS Score:7.2

    Affected Products

    Vendor
    Eidetic-labs
    Product
    Stigmem

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-76245 (CVSS 7.1) — stigmem (pip package stigmem-node) version 0.9.0a1 contains a timestamp-handling mismatch in federation peer-t…
    CVE-2026-76244 (CVSS 9.1) — stigmem-node contains an insecure default configuration vulnerability that allows federation traffic to traver…
    CVE-2026-76243 (CVSS 9.2) — stigmem versions before 0.9.0a2 allow unauthenticated access when authentication is disabled on non-loopback d…
    CVE-2026-76242 (CVSS 9.1) — stigmem-node 0.9.0a1 accepts federation peer key material during peer registration without a separate administ…
    CVE-2026-76241 (CVSS 7.3) — stigmem-node 0.9.0a1 allows plugin signature enforcement to be disabled via a single configuration flag withou…
    CVE-2026-76240 (CVSS 7.5) — stigmem-node 0.9.0a1 interpolates Postgres backend schema identifiers into SQL strings without defensive quoti…
    CVE-2026-76239 (CVSS 5.3) — Stigmem before 0.9.0a11 fails to validate the delivery_address parameter when creating webhook subscriptions, …
    CVE-2026-76238 (CVSS 7.2) — stigmem versions before 0.9.0a12 contain a broken object level authorization vulnerability in the decay sweep …
    CVE-2026-76237 (CVSS 8.6) — stigmem-node before 0.9.0a12 contains a broken object level authorization (cross-tenant BOLA) vulnerability in…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High