The vulnerability resides in the right‑to‑be‑forgotten tombstone routine of stigmem-node. During deletion a flag that records the tenant was incorrectly defaulted to "default" with the entry written to that tenant. The deletion filter for tombstone suppression then omitted a tenant identifier, so tombstones were applied across all tenants. This allows a user of one tenant to cause facts belonging to another tenant to be deleted or to elude deletion, thereby breaching data isolation and violating RTBF guarantees.

Eidetic‑Labs stigmem-node versions earlier than 0.9.0a12 that use the optional stigmem‑plugin‑multi‑tenant. Single‑tenant deployments are not impacted.

The CVSS score of 7.2 indicates a medium‑high severity. EPSS data is not available and the vulnerability is not listed in CISA KEV. Exploitation requires a multi‑tenant deployment and a legitimate account with deletion privileges. An attacker can create tombstone records that delete or hide data belonging to other tenants, effectively leaking or altering that information. The attack can be carried out by submitting a deletion request and then querying data that would normally be suppressed. Given the lack of external exposure, the risk is limited to environments where the multi‑tenant plugin is enabled.