CVE-2026-76236 Overview
CVE-2026-76236 is a cross-tenant broken object level authorization (BOLA) flaw in stigmem-node versions prior to 0.9.0a12. The vulnerability affects the right-to-be-forgotten (RTBF) tombstone mechanism used to suppress deleted records. The issue_tombstone function defaults the tenant to "default" instead of the caller's tenant. The read-suppression path also lacks a tenant_id predicate, so tombstone suppression applies tenant-blind across fact queries and provenance reads. Only multi-tenant deployments running the opt-in stigmem-plugin-multi-tenant are exploitable. Single-tenant deployments are unaffected. The issue is tracked under [CWE-639] and is fixed in 0.9.0a12.
Critical Impact
Authenticated tenants can misattribute deletion records and either hide or expose facts belonging to other tenants, breaking data isolation and RTBF guarantees.
Affected Products
- stigmem-node versions before 0.9.0a12
- Deployments using the opt-in stigmem-plugin-multi-tenant
- Multi-tenant stigmem installations relying on RTBF tombstone suppression
Discovery Timeline
- 2026-08-19 - CVE-2026-76236 published to NVD
- 2026-08-21 - Last updated in NVD database
Technical Details for CVE-2026-76236
Vulnerability Analysis
The flaw lives in the RTBF tombstone subsystem of stigmem-node. Two defects combine to break tenant isolation. First, issue_tombstone writes deletion records under the hardcoded tenant string "default" rather than resolving the caller's tenant identity. Second, the read-suppression code path, specifically _get_tombstone_filter and the tombstone scope cache, does not include a tenant_id predicate when evaluating whether to hide records.
Because suppression is evaluated tenant-blind, a tombstone issued by any tenant can suppress facts across all tenants. Deletion attribution also becomes incorrect. A tenant requesting deletion of its own data can leave the record intact while affecting records that belong to unrelated tenants. The vulnerability is classified under [CWE-639] (Authorization Bypass Through User-Controlled Key).
Root Cause
The root cause is missing tenant context propagation in the authorization key used for tombstone reads and writes. The write path substitutes a static default identifier, and the read path omits the tenant scope entirely from the filter predicate and its cache. Both changes were required to enforce tenant-scoped access on tombstone objects.
Attack Vector
Exploitation requires network access with low-privileged authenticated credentials on a multi-tenant stigmem deployment. A tenant issues a legitimate RTBF request through issue_tombstone. The resulting tombstone is written under the "default" tenant and consulted globally on subsequent reads. This lets the attacker suppress fact queries and provenance reads belonging to other tenants, or fail to suppress data within their own tenant. No user interaction is required.
Refer to the GitHub Security Advisory and the VulnCheck Advisory for authoritative technical details.
Detection Methods for CVE-2026-76236
Indicators of Compromise
- Tombstone records stored under the literal tenant identifier "default" when the issuing caller belongs to a different tenant.
- Provenance or fact-query responses returning empty result sets for tenants that did not issue an RTBF request.
- Deletion audit trails showing RTBF actions with mismatched or missing tenant_id fields.
Detection Strategies
- Audit the stigmem-node tombstone store for entries whose tenant field equals "default" and cross-reference against the authenticated caller's tenant.
- Compare pre- and post-RTBF fact-query counts per tenant to identify suppression events that cross tenant boundaries.
- Enable structured logging around issue_tombstone, _get_tombstone_filter, and the tombstone scope cache to capture tenant context on every call.
Monitoring Recommendations
- Alert on any tombstone write where the resolved tenant does not match the authenticated session tenant.
- Track query result deltas over time per tenant to surface unexpected suppression from tenant-blind filters.
- Monitor deployments for installation of the stigmem-plugin-multi-tenant plugin so vulnerable configurations are inventoried.
How to Mitigate CVE-2026-76236
Immediate Actions Required
- Upgrade stigmem-node to version 0.9.0a12 or later on all multi-tenant deployments.
- Inventory tombstone records created before the upgrade and rewrite entries currently attributed to "default" with the correct tenant identifier.
- Review RTBF audit logs to confirm that prior deletion requests actually removed the intended tenant's data.
Patch Information
The vulnerability is fixed in stigmem-node0.9.0a12. The patch propagates the caller's tenant into issue_tombstone and adds a tenant_id predicate to _get_tombstone_filter and the tombstone scope cache. Consult the GitHub Security Advisory GHSA-x26h-xmv8-gxf7 for release notes and upgrade instructions.
Workarounds
- Disable the stigmem-plugin-multi-tenant plugin and operate the deployment in single-tenant mode until the upgrade is complete.
- Restrict RTBF endpoint access to trusted administrators to reduce the number of principals capable of issuing cross-tenant tombstones.
- Suspend automated RTBF processing pipelines that call issue_tombstone until patched code is in production.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
