Vulnerability · Published Oct 8, 2026 · Assigned by mitre

CVE-2026-107450

Medium 5.4

In plain English

A medium-severity incorrect authorization in Stump from stumpapp. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.2%top 88.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations (crates/graphql/src/mutation/smart_lists.rs) depend only on the shared AccessSmartList permission and resolve the target list at Reader access (lacking a creator check). Any authenticated user with that permission can overwrite, delete, or take over another user's smart list. (updateSmartList sets creatorId to the caller identity, and can set visibility to PRIVATE, locking out the original owner.) NOTE: this is unrelated to the graphql crate on crates.io.

Affected products (as reported)

Vendor	Product	Versions
stumpapp	Stump	0 – through 0.1.10

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

References

https://github.com/kashishtopi/stump-smartlist-bola exploit, technical-description
https://github.com/stumpapp/stump/blob/42a9918/crates/graphql/src/mutation/smart_lists.rs product
https://crates.io/crates/graphql not-applicable