PatchSiren cyber security CVE debrief
CVE-2026-76236 eidetic-labs CVE debrief
The stigmem-node package before version 0.9.0a12 contains a cross-tenant broken object level authorization (BOLA) flaw in its RTBF (right-to-be-forgotten) tombstone mechanism. This issue is exploitable only in multi-tenant deployments that use the stigmem-plugin-multi-tenant. The flaw allows a tenant's deletion to be attributed to the wrong tenant and causes tombstone suppression to be applied tenant-blind, undermining data isolation and RTBF guarantees. The issue is fixed in version 0.9.0a12. Organizations using stigmem-node with the stigmem-plugin-multi-tenant, especially those handling sensitive data across multiple tenants, should be aware of this vulnerability and take steps to mitigate it. The CVE record was published on 2026-08-19T14:17:54.810Z and has not been modified since then.
- Vendor
- eidetic-labs
- Product
- stigmem-node
- CVSS
- HIGH 7.2
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-08-19
- Original CVE updated
- 2026-08-21
- Advisory published
- 2026-08-19
- Advisory updated
- 2026-08-21
Who should care
Organizations using stigmem-node with the stigmem-plugin-multi-tenant, especially those handling sensitive data across multiple tenants, should be aware of this vulnerability and take steps to mitigate it.
Technical summary
The stigmem-node package before version 0.9.0a12 contains a cross-tenant broken object level authorization (BOLA) flaw in its RTBF (right-to-be-forgotten) tombstone mechanism. This issue is exploitable only in multi-tenant deployments that use the stigmem-plugin-multi-tenant. The flaw allows a tenant's deletion to be attributed to the wrong tenant and causes tombstone suppression to be applied tenant-blind, undermining data isolation and RTBF guarantees. The issue is fixed in version 0.9.0a12.
Defensive priority
Organizations using stigmem-node before 0.9.0a12 with the stigmem-plugin-multi-tenant should prioritize upgrading to 0.9.0a12 to address the cross-tenant BOLA vulnerability.
Recommended defensive actions
- Upgrade stigmem-node to version 0.9.0a12 or later
- Review and update tenant configurations for stigmem-plugin-multi-tenant
- Monitor for suspicious activity related to RTBF tombstone mechanisms
- Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
- Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
- Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
- Check relevant monitoring, detection, and logs for exposed assets that need extra review.
Evidence notes
The CVE-2026-76236 issue involves a cross-tenant broken object level authorization flaw in stigmem-node before 0.9.0a12. The RTBF tombstone mechanism incorrectly defaulted the tenant to 'default' instead of the caller's tenant, allowing deletion records to be written to the wrong tenant. The read-suppression path lacked a tenant_id predicate, causing tombstone suppression to be applied tenant-blind. This undermines data isolation and RTBF guarantees in multi-tenant deployments using the stigmem-plugin-multi-tenant. Single-tenant deployments are unaffected.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-19T14:17:54.810Z and has not been modified since then.