CVE-2026-107450
In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations (crates/graphql/src/mutation/smart_lists.rs) depend only on the shared AccessSmartList permission and resolve the target list at Reader access (lacking a creator check). Any authenticated user with that permission can overwrite, delete, or take over another user's smart list. (updateSmartList sets creatorId to the caller identity, and can set visibility to PRIVATE, locking out the original owner.) NOTE: this is unrelated to the graphql crate on crates.io.
CVE-2026-107450
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-107450
Stump
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://github.com/stumpapp/stump",
"vendor": "stumpapp",
"modules": [
"GraphQL smart list mutations"
],
"product": "Stump",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom",
"lessThanOrEqual": "0.1.10"
}
],
"programFiles": [
"crates/graphql/src/mutation/smart_lists.rs"
],
"defaultStatus": "unknown",
"programRoutines": [
{
"name": "update_smart_list"
},
{
"name": "delete_smart_list"
}
]
}
]- Related CVEs
- CVE-2026-107450
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #12548 · Revision 1
- Added to Heist Feed
- Publisher date