CVE-2026-107450CWE-863broken-access-control

CVE-2026-107450

Medium · published October 8, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
10.9
In the wild
Unconfirmed
What it is

In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations (crates/graphql/src/mutation/smart_lists.rs) depend only on the shared AccessSmartList permission and resolve the target list at Reader access (lacking a creator check). Any authenticated user with that permission can overwrite, delete, or take over another user's smart list. (updateSmartList sets creatorId to the caller identity, and can set visibility to PRIVATE, locking out the original owner.) NOTE: this is unrelated to the graphql crate on crates.io.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00211 · 10.9th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-10-08T09:17Z
References (3)
https://crates.io/crates/graphql · [email protected]https://github.com/kashishtopi/stump-smartlist-bola · [email protected]https://github.com/stumpapp/stump/blob/42a9918/crates/graphql/src/mutation/smart_lists.rs · [email protected]
EPSS history
Timeline
  • 09 OCT 03:26Z
    EPSS moved — → 0%
    epss
  • 08 OCT 04:44Z
    In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations (crates/graphql/src/mutation/smart_lists.rs) depend only on the shared…
    cvelistv5
  • 08 OCT 04:44Z
    In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations (crates/graphql/src/mutation/smart_lists.rs) depend only on the shared…
    cvelistv5