An authorization bypass vulnerability in the Stigmem node package allows authenticated users to perform unauthorized actions on other tenants' data.

This is an authorization bypass (CWE-639) vulnerability caused by user-controlled keys. An authenticated attacker can manipulate these keys to bypass access controls and interact with data belonging to other tenants.

This vulnerability enables broken object level authorization, leading to severe data exposure and unauthorized modification of information. With a CVSS score of 8.6, the impact on data confidentiality and integrity is substantial, potentially resulting in regulatory non-compliance and loss of customer trust.

Immediate Action: Update the stigmem-node package to version 0.9.0a12 immediately.

Proactive Monitoring: Monitor API access logs for unauthorized access attempts or requests targeting resources outside of the authenticated user's scope.

Compensating Controls: Implement strict server-side authorization checks that validate ownership of requested objects independently of user-supplied keys.

Public Exploit Available: Unknown

Due to the risk of cross-tenant data compromise, it is imperative to update the affected package to 0.9.0a12. Security teams should verify that all downstream applications utilizing this package are patched to prevent unauthorized data access.