stumpapp Stump

• CVE-2026-107450 Medium 5.4 In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations (crates/graphql/src/mutation/smart_lists.rs) depend only on the shared AccessSmartList permission and resolve the tar 0.2%