CVE-2026-76243CWE-285

CVE-2026-76243

published August 19, 2026

CVSS
9.2
EPSS
1%
Percentile
46.1
In the wild
Unconfirmed
What it is

stigmem versions before 0.9.0a2 allow unauthenticated access when authentication is disabled on non-loopback deployments. Attackers can perform read, write, and federation operations with anonymous identity when nodes are exposed outside local development environments.

The record
Technical detail
CVSS
9.2 · NONE
CVSS v4.0
9.2 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00564 · 46.1th percentile
Weakness
CWE-285 · Improper Authorization
Published
2026-08-19T18:17Z
References (2)
https://github.com/eidetic-labs/stigmem/security/advisories/GHSA-fp6w-8wpg-74g5 · [email protected]https://www.vulncheck.com/advisories/stigmem-before-0a2-authentication-bypass-via-disabled-auth · [email protected]
EPSS history
Timeline
  • 19 AUG 14:02Z
    stigmem before 0.9.0a2 Authentication Bypass via Disabled Auth
    cvelistv5