CVE-2026-76237

Name of the Vulnerable Software and Affected Versions stigmem-node versions prior to 0.9.0a12

Description Broken object level authorization (BOLA) exists in the quarantine review endpoints. In multi-tenant deployments using the stigmem-plugin-multi-tenant plugin, the get quarantined fact function in routes/quarantine.py and the list/count queries lack a tenant id predicate, and the garden lookup is not tenant-scoped. This allows a tenant administrator with tenant write capabilities to list, read, admit, or reject quarantined facts from other tenants via the /v1/quarantine endpoints. BOLA is a security issue where an application does not properly verify if the user requesting access to a specific object has the necessary permissions to access that object.

Recommendations Update to version 0.9.0a12 or later. Restrict access to the /v1/quarantine endpoints to minimize the risk of exploitation until the update is applied.