CVE-2026-107450

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-08 · updated 2026-10-08
Weakness: CWE-863

Description

In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations (crates/graphql/src/mutation/smart_lists.rs) depend only on the shared AccessSmartList permission and resolve the target list at Reader access (lacking a creator check). Any authenticated user with that permission can overwrite, delete, or take over another user's smart list. (updateSmartList sets creatorId to the caller identity, and can set visibility to PRIVATE, locking out the original owner.) NOTE: this is unrelated to the graphql crate on crates.io.

Affected products

stumpapp Stump: through 0.1.10

References

https://crates.io/crates/graphql
https://github.com/kashishtopi/stump-smartlist-bola
https://github.com/stumpapp/stump/blob/42a9918/crates/graphql/src/mutation/smart_lists.rs

Get alerted when CVE-2026-107450 or the next vulnerability affects your stack