CVE-2026-76243
CVE-2026-76243 · stigmem before 0.9.0a2 Authentication Bypass via Disabled Auth
This page contains facts from public vulnerability sources. Check the original advisory before updating.
stigmem versions before 0.9.0a2 allow unauthenticated access when authentication is disabled on non-loopback deployments. Attackers can perform read, write, and federation operations with anonymous identity when nodes are exposed outside local development environments.
CVSS 9.2 · Critical · EPSS 0.6% · Fix available
- Published
- Updated
Stack: python
Affected products and versions
stigmem
- Versions
- ≥ 0, < 0.9.0a2: Affected (custom)
- 0.9.0a2: Not affected (custom)
Update to 0.9.0a2
stigmem-node PyPI
- Versions
- 0.9.0a1
- Affected ranges
- ECOSYSTEM: < 0.9.0a2
Update to 0.9.0a2