---
id: CVE-2026-107450
title: >-
  In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL
  mutations (crates/graphql/src/mutation/smart_lists.rs) depend only on the
  shared AccessSmartList permission and resolve the target list at Reader access
  (lacking a …
summary: >-
  In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL
  mutations (crates/graphql/src/mutation/smart_lists.rs) depend only on the
  shared AccessSmartList permission and resolve the target list at Reader access
  (lacking a …
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L'
cwe:
  - CWE-863
vendor: stumpapp
product: Stump
affected:
  - Stump <= 0.1.10
published: '2026-10-08'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T06:16:41.347'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-107450'
references:
  - url: 'https://crates.io/crates/graphql'
    label: cve@mitre.org
  - url: 'https://github.com/kashishtopi/stump-smartlist-bola'
    label: cve@mitre.org
  - url: >-
      https://github.com/stumpapp/stump/blob/42a9918/crates/graphql/src/mutation/smart_lists.rs
    label: cve@mitre.org
tags:
  - nvd
  - cve.org
ingestedAt: '2026-10-08T05:05:36.676Z'
---

## Overview

In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations (crates/graphql/src/mutation/smart_lists.rs) depend only on the shared AccessSmartList permission and resolve the target list at Reader access (lacking a creator check). Any authenticated user with that permission can overwrite, delete, or take over another user's smart list. (updateSmartList sets creatorId to the caller identity, and can set visibility to PRIVATE, locking out the original owner.) NOTE: this is unrelated to the graphql crate on crates.io.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.