The vulnerability exists in versions of stigmem prior to 0.9.0a12 and is caused by a broken object‑level authorization flaw in the decay sweep endpoint. Authenticated users who possess write permissions for a particular tenant can submit POST requests that trigger decay operations globally. By setting ttl_seconds to 0, these users can cause all facts to expire across every tenant, effectively deleting cross‑tenant data. In addition, using the dry_run flag allows the attacker to discover the number of facts and the presence of data for tenants they do not own, leaking sensitive tenant‑level information. The primary impact is a breach of confidentiality, integrity, and availability for all tenants involved, as data can be indiscriminately removed or revealed by an attacker with limited permissions within a single tenant.

Version 0.9.0a12 or later of the stigmem product from Eidetic Labs include the fix for this vulnerability. Users running any earlier version of stigmem are susceptible. This includes all installations of stigmem before 0.9.0a12, regardless of deployment environment.

The CVSS score of 7.2 indicates a high risk level. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that it has not yet been widely exploited. The likely attack vector requires an authenticated user possessing write privileges for at least one tenant. The attacker can exploit the flaw by sending crafted POST requests to the /decay-sweep endpoint, thereby affecting all tenants. The overall risk is moderate to high when considering the potential for widespread data loss or exposure across multiple tenants, especially in multi‑tenant deployments where a compromise of a single tenant can lead to a cross‑tenant breach.