CVE-2026-76238: stigmem Auth Bypass Vulnerability

CVE-2026-76238 Overview

CVE-2026-76238 is a broken object level authorization (BOLA) vulnerability in stigmem versions before 0.9.0a12. The flaw resides in the decay sweep endpoint, which fails to enforce tenant boundaries on authenticated requests. An attacker holding write credentials for a single tenant can invoke the endpoint to affect data across every tenant hosted on the instance. The issue is tracked as CWE-863: Incorrect Authorization.

Critical Impact
Authenticated attackers with single-tenant write access can expire facts across all tenants by submitting a POST request with ttl_seconds=0, or enumerate cross-tenant fact counts using the dry_run parameter.

Affected Products

stigmem versions prior to 0.9.0a12
Multi-tenant deployments exposing the decay sweep endpoint
Any application embedding vulnerable stigmem builds

Discovery Timeline

2026-08-19 - CVE-2026-76238 published to NVD
2026-08-21 - Last updated in NVD database

Technical Details for CVE-2026-76238

Vulnerability Analysis

The decay sweep endpoint in stigmem performs bulk expiration of stored facts based on time-to-live parameters. The endpoint authenticates the caller but does not scope the sweep operation to the caller's tenant identifier. As a result, the authorization check verifies that the user has write credentials somewhere in the system without confirming that the target objects belong to that user's tenant. This is a textbook broken object level authorization failure, classified under CWE-863.

The vulnerability impacts both integrity and availability. Data owned by other tenants can be forcibly expired, and confidentiality is partially affected because attackers can infer the existence and counts of records across tenants via the endpoint's dry-run mode.

Root Cause

The root cause is missing tenant scoping in the decay sweep handler. The endpoint accepts a ttl_seconds parameter that is applied globally rather than being filtered by the caller's tenant context. The authorization layer confirms the caller can write to at least one tenant but does not restrict the affected object set to that tenant's namespace.

Attack Vector

Exploitation requires network access to the API and valid credentials for any tenant with write privileges. The attacker issues a POST request to the decay sweep endpoint with ttl_seconds=0, forcing every fact across all tenants to be considered expired. Alternatively, the attacker sets dry_run=true to receive counts and existence signals for records outside the attacker's tenant, enabling cross-tenant reconnaissance without triggering deletions. Refer to the GitHub Security Advisory and the VulnCheck Security Advisory for the endpoint's request schema.

Detection Methods for CVE-2026-76238

Indicators of Compromise

POST requests to the decay sweep endpoint containing ttl_seconds=0 from low-privilege tenant accounts
Requests to the decay sweep endpoint including dry_run=true from accounts that do not typically administer decay policies
Unexpected mass fact-expiration events affecting multiple tenants within a short window
Sudden gaps in tenant fact stores that correlate with a single authenticated session

Detection Strategies

Correlate API access logs against tenant ownership of affected records to identify cross-tenant object references
Alert on any decay sweep invocation where ttl_seconds equals 0 or is below an operational baseline
Baseline normal callers of the decay sweep endpoint and flag new principals invoking it

Monitoring Recommendations

Enable verbose request logging on the decay sweep endpoint including caller identity, tenant claim, and request body
Ship API telemetry to a centralized log platform and retain it for post-incident forensics
Emit metrics on records expired per sweep and page on anomalous spikes

How to Mitigate CVE-2026-76238

Immediate Actions Required

Upgrade stigmem to version 0.9.0a12 or later on all deployments
Rotate API credentials for any tenant that may have been used to trigger unauthorized sweeps
Audit historical decay sweep invocations for cross-tenant impact and restore expired facts from backups where required

Patch Information

The fix ships in stigmem0.9.0a12, which enforces tenant scoping on the decay sweep endpoint. Details are published in the GitHub Security Advisory GHSA-6gqw-jqv7-v88m and mirrored in the VulnCheck Security Advisory.

Workarounds

Restrict network access to the decay sweep endpoint using an API gateway or reverse proxy until the patch is deployed
Limit write credentials to trusted service accounts and revoke unused tenant API keys
Add a middleware guard that rejects decay sweep requests missing an explicit tenant identifier matching the caller's claim

bash

# Example gateway rule blocking decay sweep until upgrade completes
# (adapt to your ingress/WAF syntax)
deny request where path == "/api/decay/sweep" and method == "POST"