CVE-2026-76238: stigmem before 0.9.0a12 Cross-Tenant BOLA via decay sweep
stigmem versions before 0.9.0a12 contain a broken object level authorization vulnerability in the decay sweep endpoint that allows authenticated attackers with write credentials for one tenant to execute decay operations affecting all tenants. Attackers can submit POST requests to the decay sweep endpoint with ttlseconds=0 to expire facts across all tenants, or use dryrun to obtain cross-tenant fact counts and existence information.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
stigmemto a version that resolves this vulnerability.Fixed in 0.9.0a12 - Configuration
Prevent or reject decay-sweep requests where ttl_seconds=0, since ttl_seconds=0 can be used to expire facts across all tenants.
stigmem decay sweep endpoint ttl_seconds = 0 - Configuration
Prevent or restrict the use of dry_run on the decay sweep endpoint, since dry_run can expose cross-tenant fact counts and existence information.
stigmem decay sweep endpoint dry_run = true - Compensating control
Constrain access to the decay sweep endpoint so only authorized callers/tenants can execute decay operations for their own tenant (e.g., enforce tenant-scoped authorization and block cross-tenant effects).
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and have write credentials for at least one tenant. The flaw then allows decay sweep operations to affect data belonging to all tenants.
What is the practical impact of exploitation?
Submitting a decay sweep request with ttl_seconds=0 can expire facts across all tenants. Using dry_run can disclose cross-tenant fact counts and information about whether facts exist.
Are installations running the fixed release affected?
The issue affects stigmem versions before 0.9.0a12. Installations running 0.9.0a12 or later are not identified as affected by the provided advisory data.