Incorrect authorization in Stump smart list mutations
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · Low
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-863.
Summary
Stump through 0.1.10 has incorrect authorization in its updateSmartList and deleteSmartList GraphQL mutations. Both rely only on the shared AccessSmartList permission and do not check the list's creator, so any authenticated user with that permission can overwrite, delete, or take over another user's smart list (CWE-863). A public exploit is linked in the references.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations (crates/graphql/src/mutation/smart_lists.rs) depend only on the shared AccessSmartList permission and resolve the target list at Reader access (lacking a creator check). Any authenticated user with that permission can overwrite, delete, or take over another user's smart list. (updateSmartList sets creatorId to the caller identity, and can set visibility to PRIVATE, locking out the original owner.) NOTE: this is unrelated to the graphql crate on crates.io.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for Stump.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Timeline
- 2026-10-08 Threatist record created from CVE-2026-107450
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences