CVE-2026-76237 stigmem before 0.9.0a12 Cross-Tenant BOLA via quarantine
Cross-tenant BOLA in stigmem-node allows tenant admins to access and modify other tenants' quarantined facts in multi-tenant setups.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-76237?
CVE-2026-76237 is a high-severity missing authorization vulnerability in eidetic-labs stigmem-node, published on 19 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
stigmem-node before 0.9.0a12 contains a broken object level authorization (cross-tenant BOLA) vulnerability in the quarantine review endpoints. On multi-tenant deployments running the opt-in stigmem-plugin-multi-tenant, the list/count queries and _get_quarantined_fact in routes/quarantine.py lacked a tenant_id predicate and the garden lookup was not tenant-scoped, allowing a tenant administrator with only a plain tenant write capability to list, read, and admit or reject quarantined facts belonging to other tenants via the /v1/quarantine endpoints. Default single-tenant deployments are not affected.
Weakness: CWE-639
Which versions are affected by CVE-2026-76237?
2 open source packages ship an affected version, including stigmem-node.
| Package | Affected | Fixed in |
|---|---|---|
stigmem-node PyPI | All versions | 0.9.0a12 |
stigmem-node PyPI | All versions | 0.9.0a12 |
How do I fix CVE-2026-76237?
Upgrade stigmem-node to 0.9.0a12 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-76237 being exploited?
There is no known exploitation of CVE-2026-76237 in the wild and no public exploit code.
Sources
Also known as GHSA-w2cf-363h-rwff, GHSA-xhv3-q4xx-349r.