PatchSiren cyber security CVE debrief
CVE-2026-76237 eidetic-labs CVE debrief
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-19T14:17:55.840Z and has not been modified since then. The stigmem-node package before version 0.9.0a12 contains a broken object level authorization (cross-tenant BOLA) vulnerability in its quarantine review endpoints. This issue affects multi-tenant deployments that use the stigmem-plugin-multi-tenant. The vulnerability arises from list/count queries and the _get_quarantined_fact function in routes/quarantine.py lacking a tenant_id predicate. Additionally, the garden lookup is not tenant-scoped, which allows a tenant administrator with only a plain tenant write capability to list, read, and admit or reject quarantined facts belonging to other tenants via the /v1/quarantine endpoints. Administrators and security teams should review and update stigmem-node to version 0.9.0a12 or later, verify tenant configurations and access controls, and monitor for suspicious activity.
- Vendor
- eidetic-labs
- Product
- stigmem-node
- CVSS
- HIGH 8.6
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-08-19
- Original CVE updated
- 2026-08-21
- Advisory published
- 2026-08-19
- Advisory updated
- 2026-08-21
Who should care
Administrators and security teams responsible for stigmem-node deployments, especially those using multi-tenant configurations, should be aware of this vulnerability and take immediate action to mitigate the risk.
Technical summary
The stigmem-node package before version 0.9.0a12 contains a broken object level authorization (cross-tenant BOLA) vulnerability in its quarantine review endpoints. This issue affects multi-tenant deployments that use the stigmem-plugin-multi-tenant. The vulnerability arises from list/count queries and the _get_quarantined_fact function in routes/quarantine.py lacking a tenant_id predicate. Additionally, the garden lookup is not tenant-scoped, which allows a tenant administrator with only a plain tenant write capability to list, read, and admit or reject quarantined facts belonging to other tenants via the /v1/quarantine endpoints.
Defensive priority
CVE-2026-76237 is rated HIGH with a CVSS score of 8.6, indicating a significant vulnerability. The broken object level authorization (cross-tenant BOLA) vulnerability in stigmem-node before 0.9.0a12 could allow a tenant administrator to list, read, and admit or reject quarantined facts belonging to other tenants on multi-tenant deployments.
Recommended defensive actions
- Review and update stigmem-node to version 0.9.0a12 or later
- Verify tenant configurations and access controls for quarantine review endpoints
- Monitor for suspicious activity on /v1/quarantine endpoints
- Implement compensating controls for multi-tenant deployments
- Conduct regular security audits and vulnerability assessments
Evidence notes
The vulnerability exists in the quarantine review endpoints of stigmem-node before 0.9.0a12. On multi-tenant deployments with the stigmem-plugin-multi-tenant, list/count queries and _get_quarantined_fact in routes/quarantine.py lacked a tenant_id predicate, and the garden lookup was not tenant-scoped. This allows a tenant administrator with only a plain tenant write capability to access quarantined facts of other tenants via /v1/quarantine endpoints.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-19T14:17:55.840Z and has not been modified since then.