eidetic-labs stigmem up to 0.9.0a11 Quarantine routes/quarantine.py _get_quarantined_fact tenant_id authorization

Summaryinfo

A vulnerability was found in eidetic-labs stigmem up to 0.9.0a11. It has been declared as problematic. Impacted is the function _get_quarantined_fact of the file routes/quarantine.py of the component Quarantine. Executing a manipulation of the argument tenant_id can lead to authorization. This vulnerability is tracked as CVE-2026-76237. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability classified as problematic was found in eidetic-labs stigmem up to 0.9.0a11. This vulnerability affects the function _get_quarantined_fact of the file routes/quarantine.py of the component Quarantine. The manipulation of the argument tenant_id with an unknown input leads to a authorization vulnerability. The CWE definition for the vulnerability is CWE-639. The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

stigmem-node before 0.9.0a12 contains a broken object level authorization (cross-tenant BOLA) vulnerability in the quarantine review endpoints. On multi-tenant deployments running the opt-in stigmem-plugin-multi-tenant, the list/count queries and _get_quarantined_fact in routes/quarantine.py lacked a tenant_id predicate and the garden lookup was not tenant-scoped, allowing a tenant administrator with only a plain tenant write capability to list, read, and admit or reject quarantined facts belonging to other tenants via the /v1/quarantine endpoints. Default single-tenant deployments are not affected.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-76237 since 08/19/2026. The exploitation appears to be easy. The attack can be initiated remotely. Additional levels of successful authentication are required for exploitation. There are known technical details, but no exploit is available.

Upgrading to version 0.9.0a12 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• eidetic-labs

Name

• stigmem

Version

• 0.9.0a11

Website

• Product: https://github.com/eidetic-labs/stigmem/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion