Security readout for executives and security teams
Plain-English summary
Internet- or network-exposed stigmem nodes can become fully accessible without credentials when authentication is disabled. On vulnerable versions, an anonymous attacker could read or alter stored information and use federation functions, threatening confidentiality, integrity, and availability. Local-only development instances are less exposed.
Executive priority
Act immediately on any reachable vulnerable deployment because compromise could expose or alter all data handled by the node. Prioritize internet-facing and broadly accessible internal instances, then federation peers. Assign owners to upgrade, restrict access, verify authentication, and review logs. Local-only instances should still be inventoried and updated through normal emergency-change controls.
Technical view
CVE-2026-76243 is a CWE-285 authorization failure affecting stigmem versions before 0.9.0a2. When authentication is disabled and a node listens beyond loopback, requests receive anonymous identity with read, write, and federation capabilities. The supplied CVSS 4.0 score is 9.2, with network access, low complexity, and no privileges or user interaction required.
Likely exposure
Highest exposure exists where stigmem before 0.9.0a2 has authentication disabled and is reachable through a non-loopback interface, public endpoint, internal network, proxy, or federation path. Loopback-only development deployments are not described as vulnerable to remote access. Actual exposure requires configuration and network-path verification.
Exploitation context
The bundle reports no CISA KEV listing and provides no evidence of active exploitation. Exploitation requires the vulnerable configuration: disabled authentication on a node exposed beyond loopback. Under those conditions, no credentials or user interaction are required. Treat reachable deployments as urgent despite the absence of confirmed in-the-wild activity.
Researcher notes
The supplied affected range is expressed narratively as versions before 0.9.0a2; validate exact installed prerelease versions against the vendor advisory. The decisive exposure factors are disabled authentication and non-loopback reachability. No public exploitation evidence, exploit maturity assessment, affected downstream products, or detailed forensic indicators are included in the bundle.
Mitigation direction
- Upgrade stigmem to version 0.9.0a2 or later.
- Enable authentication on every deployment reachable beyond loopback.
- Restrict network access to trusted systems until upgrading and validating configuration.
- Review current vendor guidance for any additional release-specific precautions.
Validation and detection
- Inventory stigmem versions across production, staging, development, and federation nodes.
- Identify nodes with authentication disabled or an anonymous access mode.
- Confirm each node's listening interfaces, proxy exposure, firewall rules, and federation reachability.
- Verify unauthenticated requests cannot perform read, write, or federation operations.
- Review access logs for unexpected anonymous operations and investigate affected data.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-285: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-76243 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.2 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
9.2CriticalVector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- GitHub Security Advisory (GHSA-fp6w-8wpg-74g5)CVE reference, VulnCheck · vendor-advisory
- VulnCheck Advisory: stigmem before 0.9.0a2 Authentication Bypass via Disabled AuthCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Authorization
Improper Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.