CVE-2026-107450: High severity Stump Stump vulnerability
In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations (crates/graphql/src/mutation/smartlists.rs) depend only on the shared AccessSmartList permission and resolve the target list at Reader access (lacking a creator check). Any authenticated user with that permission can overwrite, delete, or take over another user's smart list. (updateSmartList sets creatorId to the caller identity, and can set visibility to PRIVATE, locking out the original owner.) NOTE: this is unrelated to the graphql crate on crates.io.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Stump versions through 0.1.10 are affected where users can authenticate and are granted the shared AccessSmartList permission.
What level of access is required to exploit this issue?
An attacker needs an authenticated account with the AccessSmartList permission. No additional creator or ownership check is required for the targeted smart list.
Can exploitation lock the original creator out of a smart list?
Yes. The updateSmartList mutation can set the smart list's creatorId to the caller and change its visibility to PRIVATE, which can prevent the original owner from accessing it.