CVE-2026-107450: CWE-863 Incorrect Authorization in stumpapp Stump
Description
In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations (crates/graphql/src/mutation/smart_lists.rs) depend only on the shared AccessSmartList permission and resolve the target list at Reader access (lacking a creator check). Any authenticated user with that permission can overwrite, delete, or take over another user's smart list. (updateSmartList sets creatorId to the caller identity, and can set visibility to PRIVATE, locking out the original owner.) NOTE: this is unrelated to the graphql crate on crates.io.
CVSS v3.1
Score 5.4medium
Affected software
stumpapp
Stump
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In Stump through version 0.1.10, the GraphQL mutations updateSmartList and deleteSmartList depend only on the shared AccessSmartList permission and resolve the target list at Reader access without checking if the caller is the creator. This flaw enables any authenticated user with AccessSmartList permission to overwrite, delete, or assume control of another user's smart list. Specifically, updateSmartList sets the creatorId to the caller's identity and can set the visibility to PRIVATE, effectively locking out the original owner. This vulnerability is unrelated to the graphql crate on crates.io.
Potential Impact
An attacker with the AccessSmartList permission can modify or delete smart lists belonging to other users, potentially disrupting user data and workflows. They can also take over ownership of smart lists and restrict access by setting visibility to PRIVATE. This leads to integrity and availability impacts but does not directly affect confidentiality.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict AccessSmartList permissions to trusted users only to minimize risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mitre
- Date Reserved
- 2026-10-08T04:44:46.580Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ac720c12cdf04f656e2661c
Added to database: 10/08/2026, 04:49:05 UTC
Last enriched: 10/08/2026, 05:03:27 UTC
Last updated: 10/08/2026, 05:48:57 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.