Incorrect Authorization Affecting stigmem-node package, versions [,0.9.0a12)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Incorrect Authorization vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-PYTHON-STIGMEMNODE-17661127
- published28 Jun 2026
- disclosed19 Jun 2026
- creditUnknown
Introduced: 19 Jun 2026
New CVE NOT AVAILABLE CWE-639 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade stigmem-node to version 0.9.0a12 or higher.
Overview
stigmem-node is a Stigmem reference node — single-host production implementation
Affected versions of this package are vulnerable to Incorrect Authorization in the routes/quarantine.py process. An attacker can access and modify other tenants' quarantined data by sending requests to the /v1/quarantine list and admit/reject endpoints without proper tenant isolation. This is only exploitable if the deployment is running the opt-in stigmem-plugin-multi-tenant configuration.