stumpapp Stump up to 0.1.10 Smart List Mutations smart_lists.rs updateSmartList/deleteSmartList creatorId/visibility permission

Summaryinfo

A vulnerability was found in stumpapp Stump up to 0.1.10. It has been rated as critical. Affected by this vulnerability is the function updateSmartList/deleteSmartList of the file crates/graphql/src/mutation/smart_lists.rs of the component Smart List Mutations. This manipulation of the argument creatorId/visibility causes permission. This vulnerability is handled as CVE-2026-107450. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability classified as critical was found in stumpapp Stump up to 0.1.10. Affected by this vulnerability is the function updateSmartList/deleteSmartList of the file crates/graphql/src/mutation/smart_lists.rs of the component Smart List Mutations. The manipulation of the argument creatorId/visibility with an unknown input leads to a permission vulnerability. The CWE definition for the vulnerability is CWE-275. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations (crates/graphql/src/mutation/smart_lists.rs) depend only on the shared AccessSmartList permission and resolve the target list at Reader access (lacking a creator check). Any authenticated user with that permission can overwrite, delete, or take over another user's smart list. (updateSmartList sets creatorId to the caller identity, and can set visibility to PRIVATE, locking out the original owner.) NOTE: this is unrelated to the graphql crate on crates.io.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-107450 since 10/08/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/08/2026). MITRE ATT&CK project uses the attack technique T1222 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• stumpapp

Name

• Stump

Version

• 0.1.0
• 0.1.1
• 0.1.2
• 0.1.3
• 0.1.4
• 0.1.5
• 0.1.6
• 0.1.7
• 0.1.8
• 0.1.9
• 0.1.10

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion