Versions of the stigmem application prior to 0.9.0a2 permit unauthenticated access when the authentication feature is disabled. This flaw allows an attacker to perform arbitrary read, write, and federation operations with the same privileges as an anonymous user, effectively providing full control over all exposed resources. The underlying weakness is a lack of access control when authentication is disabled, classified as CWE‑285.

The vulnerability affects all installations of eidetic‑labs' stigmem up to and including versions earlier than 0.9.0a2. Any deployment that has disabled authentication and is reachable from outside the localhost namespace is susceptible. No specific sub‑versions are listed beyond the overall cutoff of 0.9.0a2.

The CVSS score of 9.2 indicates a high severity level. The EPSS score was not provided, so the precise probability of exploitation cannot be quantified from this data. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remotely accessing the application over a network when authentication is turned off, allowing an attacker to execute any operation permitted to an anonymous session.