THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-76236 — stigmem-node before 0.9.0a12 contains a cross-tenant broken object level authorization (BOLA) flaw in the RTBF (right-to-be-forgotten) tombstone mechanism. issue_tombstone defaulted the tenant to "default" instead of the caller's tenant, allowing deletion records to be written to

[NVD] CVE-2026-76236 — stigmem-node before 0.9.0a12 contains a cross-tenant broken object level authorization (BOLA) flaw in the RTBF (right-to-be-forgotten) tombstone mechanism. issue_tombstone defaulted the tenant to "default" instead of the caller's tenant, allowing deletion records to be written to

mednvdPublished 2026-08-19

CVE-2026-76236 CVSS: None Published: 2026-08-19T14:17:54.810

stigmem-node before 0.9.0a12 contains a cross-tenant broken object level authorization (BOLA) flaw in the RTBF (right-to-be-forgotten) tombstone mechanism. issue_tombstone defaulted the tenant to "default" instead of the caller's tenant, allowing deletion records to be written to the wrong tenant, and the read-suppression path (_get_to

Indicators of compromise

CVE-2026-76236cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-76236