CVE-2026-107450

In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations (crates/graphql/src/mutation/smart_lists.rs) depend only on the shared AccessSmartList permission and resolve the target list at Reader access (lacking a creator check). Any authenticated user with that permission can overwrite, delete, or take over another user's smart list. (updateSmartList sets creatorId to the caller identity, and can set visibility to PRIVATE, locking out the original owner.) NOTE: this is unrelated to the graphql crate on crates.io.

CVSS 3.1

5.4CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

EPSS

0.2% chance of exploitation in the next 30 days; higher than 11% of CVEs (scores of 2026-10-25)

CWE

CWE-863

Published

2026-10-08

Modified

2026-10-08

Record from

the NVD, synced 2026-10-19

References

• https://crates.io/crates/graphql
• https://github.com/kashishtopi/stump-smartlist-bola
• https://github.com/stumpapp/stump/blob/42a9918/crates/graphql/src/mutation/smart_lists.rs

Check your stackJSON