Auth bypass in Stumpapp Stump
CVE-2026-107450
In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations (crates/graphql/src/mutation/smart_lists.rs) depend only on the shared AccessSmartList permission and resolve the target list at Reader access (lacking a creator check). Any authenticated user with that permission can overwrite, delete, or take over another user's smart list. (updateSmartList sets creatorId to the caller identity, and can set visibility to PRIVATE, locking out the original owner.) NOTE: this is unrelated to the graphql crate on crates.io.
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- github.com/kashishtopi/stump-smartlist-bola (technical-description, exploit)
- github.com/stumpapp/stump/blob/42a9918/crates/graphql/src/mutation/smart_lists… (product)
- crates.io/crates/graphql (not-applicable)
Frequently asked questions
- What is CVE-2026-107450?
- CVE-2026-107450 is a medium-severity vulnerability in Stumpapp Stump, classified under Incorrect Authorization. CVSS score: 5.4/10. Published 2026-10-08.
- How severe is CVE-2026-107450?
- Medium severity. CVSS v3 base score is 5.4 out of 10.