{"cve":"CVE-2026-76238","nvd":{"published":"2026-08-19T14:17:56.013","modified":"2026-09-24T20:43:32.537","status":"Deferred","description":"stigmem versions before 0.9.0a12 contain a broken object level authorization vulnerability in the decay sweep endpoint that allows authenticated attackers with write credentials for one tenant to execute decay operations affecting all tenants. Attackers can submit POST requests to the decay sweep endpoint with ttl_seconds=0 to expire facts across all tenants, or use dry_run to obtain cross-tenant fact counts and existence information.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N","score":7.2},"cvss_v3":null,"cwes":["CWE-863"],"references":["https://github.com/eidetic-labs/stigmem/security/advisories/GHSA-6gqw-jqv7-v88m","https://www.vulncheck.com/advisories/stigmem-before-0a12-cross-tenant-bola-via-decay-sweep"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:49:38.260478770+00:00"},"epss":{"cve":"CVE-2026-76238","score":0.00364,"percentile":0.30286,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-6gqw-jqv7-v88m","url":"https://osv.dev/vulnerability/GHSA-6gqw-jqv7-v88m","summary":"stigmem-node: decay sweep expires and counts facts across all tenants (cross-tenant BOLA)","modified":"2026-08-20T04:04:15.541792931Z","packages":[{"ecosystem":"PyPI","name":"stigmem-node","purl":"pkg:pypi/stigmem-node","ranges":["<0.9.0a12"],"fixed":["0.9.0a12"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}