CVE-2026-76238CWE-863broken-access-control

CVE-2026-76238

published August 19, 2026

CVSS
7.2
EPSS
0%
Percentile
29.1
In the wild
Unconfirmed
What it is

stigmem versions before 0.9.0a12 contain a broken object level authorization vulnerability in the decay sweep endpoint that allows authenticated attackers with write credentials for one tenant to execute decay operations affecting all tenants. Attackers can submit POST requests to the decay sweep endpoint with ttl_seconds=0 to expire facts across all tenants, or use dry_run to obtain cross-tenant fact counts and existence information.

The record
Technical detail
CVSS
7.2 · NONE
CVSS v4.0
7.2 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00364 · 29.1th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-08-19T18:17Z
References (2)
https://github.com/eidetic-labs/stigmem/security/advisories/GHSA-6gqw-jqv7-v88m · [email protected]https://www.vulncheck.com/advisories/stigmem-before-0a12-cross-tenant-bola-via-decay-sweep · [email protected]
EPSS history
Timeline
  • 19 AUG 14:02Z
    stigmem before 0.9.0a12 Cross-Tenant BOLA via decay sweep
    cvelistv5