The affected component lacks proper tenant scoping for quarantine review endpoints, allowing a tenant administrator with only write privileges to list, read, and admit or reject quarantined facts from other tenants. This broken object‑level authorization results in unauthorized disclosure and manipulation of sensitive data belonging to other tenants, potentially compromising their quarantine decisions.

The flaw exists in stigmem-node prior to version 0.9.0a12 when the stigmem-plugin-multi‑tenant is enabled in a multi‑tenant deployment. Default single‑tenant installations are not affected.

With a CVSS score of 8.6 and no publicly available exploit probability data, the vulnerability poses a high risk to organizations running multi‑tenant deployments. An attacker must possess tenant‑level administrative credentials (a role normally available to legitimate tenant administrators) and then target the /v1/quarantine endpoints to retrieve or alter other tenants’ quarantine data. Because the attack requires authentication and is limited to tenant‑admin scope, impact is confined to tenants whose administrators are compromised or misused, but the breadth of data exposed can be significant. The vulnerability is not currently listed in the CISA KEV catalog.