CVE-2026-76236

stigmem-node before 0.9.0a12 contains a cross-tenant broken object level authorization BOLA flaw in the RTBF right-to-be-forgotten tombstone mechanism. issuetombstone defaulted the tenant to "default" instead of the caller's tenant, allowing deletion records to be written to the wrong tenant, and...

CVE-2026-76238 stigmem before 0.9.0a12 Cross-Tenant BOLA via decay sweep

stigmem versions before 0.9.0a12 contain a broken object level authorization vulnerability in the decay sweep endpoint that allows authenticated attackers with write credentials for one tenant to execute decay operations affecting all tenants. Attackers can submit POST requests to the decay sweep...

EUVD-2026-62478

stigmem versions before 0.9.0a12 contain a broken object level authorization vulnerability in the decay sweep endpoint that allows authenticated attackers with write credentials for one tenant to execute decay operations affecting all tenants. Attackers can submit POST requests to the decay sweep...

CVE-2026-76238 stigmem before 0.9.0a12 Cross-Tenant BOLA via decay sweep

stigmem versions before 0.9.0a12 contain a broken object level authorization vulnerability in the decay sweep endpoint that allows authenticated attackers with write credentials for one tenant to execute decay operations affecting all tenants. Attackers can submit POST requests to the decay sweep...

CVE-2026-76236 stigmem before 0.9.0a12 Cross-Tenant BOLA via Tombstones

stigmem-node before 0.9.0a12 contains a cross-tenant broken object level authorization BOLA flaw in the RTBF right-to-be-forgotten tombstone mechanism. issuetombstone defaulted the tenant to "default" instead of the caller's tenant, allowing deletion records to be written to the wrong tenant, and...

CVE-2026-76237

stigmem-node before 0.9.0a12 has a cross-tenant BOLA flaw in quarantine review endpoints: list/count queries and _get_quarantined_fact in routes/quarantine.py lack a tenant_id predicate, and the garden lookup is not tenant-scoped, allowing a low-privilege tenant admin to read, admit, or reject ot...

CVE-2026-76236

stigmem-node before 0.9.0a12 contains a cross-tenant BOLA flaw in its RTBF (right-to-be-forgotten) tombstone mechanism. Two defects combine: issue_tombstone defaulted the tenant to "default" instead of the caller's tenant, and the read-suppression path (_get_tombstone_filter and _tombstone_scope_...

EUVD-2026-62476

stigmem-node before 0.9.0a12 contains a cross-tenant broken object level authorization BOLA flaw in the RTBF right-to-be-forgotten tombstone mechanism. issuetombstone defaulted the tenant to "default" instead of the caller's tenant, allowing deletion records to be written to the wrong tenant, and...

CVE-2026-76237 stigmem before 0.9.0a12 Cross-Tenant BOLA via quarantine

stigmem-node before 0.9.0a12 contains a broken object level authorization cross-tenant BOLA vulnerability in the quarantine review endpoints. On multi-tenant deployments running the opt-in stigmem-plugin-multi-tenant, the list/count queries and getquarantinedfact in routes/quarantine.py lacked a...

EUVD-2026-62477

stigmem-node before 0.9.0a12 contains a broken object level authorization cross-tenant BOLA vulnerability in the quarantine review endpoints. On multi-tenant deployments running the opt-in stigmem-plugin-multi-tenant, the list/count queries and getquarantinedfact in routes/quarantine.py lacked a...

CVE-2026-76237 stigmem before 0.9.0a12 Cross-Tenant BOLA via quarantine

stigmem-node before 0.9.0a12 contains a broken object level authorization cross-tenant BOLA vulnerability in the quarantine review endpoints. On multi-tenant deployments running the opt-in stigmem-plugin-multi-tenant, the list/count queries and getquarantinedfact in routes/quarantine.py lacked a...

CVE-2026-76236 stigmem before 0.9.0a12 Cross-Tenant BOLA via Tombstones

stigmem-node before 0.9.0a12 contains a cross-tenant broken object level authorization BOLA flaw in the RTBF right-to-be-forgotten tombstone mechanism. issuetombstone defaulted the tenant to "default" instead of the caller's tenant, allowing deletion records to be written to the wrong tenant, and...

PT-2026-78417

Name of the Vulnerable Software and Affected Versions stigmem-node versions prior to 0.9.0a12 Description A broken object level authorization BOLA flaw exists in the right-to-be-forgotten RTBF tombstone mechanism. The issue tombstone function defaulted the tenant to "default" instead of the...

PT-2026-78419

Name of the Vulnerable Software and Affected Versions stigmem versions prior to 0.9.0a12 Description An issue exists in the decay sweep endpoint where broken object level authorization allows authenticated attackers with write credentials for a single tenant to perform decay operations across all...

PT-2026-78418

Name of the Vulnerable Software and Affected Versions stigmem-node versions prior to 0.9.0a12 Description Broken object level authorization BOLA exists in the quarantine review endpoints. In multi-tenant deployments using the stigmem-plugin-multi-tenant plugin, the get quarantined fact function i...

CVE-2026-49228

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product operations allow a low-privileged Vendor to access products owned by another Vendor. The admin/controller/product/products.php controller accepts a...

EUVD-2026-61038

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post revision operations allow a low-privileged Author to access revisions for posts owned by another Author. The admin/controller/content/revisions.php controll...

CVE-2026-49222

In Vvveb versions before 1.0.8.4, the admin/sql/sqlite/product_question.sql queries accept a caller-controlled product_question_id without verifying that product_question.product_id belongs to the current vendor's admin_id. A low-privileged vendor can read, approve, edit, or delete questions unde...

CVE-2026-49228 Vvveb product authorization bypass allows Vendors to read, duplicate, or delete other Vendors' products

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product operations allow a low-privileged Vendor to access products owned by another Vendor. The admin/controller/product/products.php controller accepts a...

CVE-2026-49226 Vvveb post authorization bypass allows Authors to view, duplicate, or delete other Authors' posts

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post operations allow a low-privileged Author to access posts owned by another Author. The admin/controller/content/posts.php controller permits filteradminid to...