CVE-2026-107450

5.4 Moyenne

Publiée le 08/10/2026 à 07:17 · Modifiée le 08/10/2026 à 23:35 · Analyse NVD reportée · Source : cve@mitre.org

Description

In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations (crates/graphql/src/mutation/smart_lists.rs) depend only on the shared AccessSmartList permission and resolve the target list at Reader access (lacking a creator check). Any authenticated user with that permission can overwrite, delete, or take over another user's smart list. (updateSmartList sets creatorId to the caller identity, and can set visibility to PRIVATE, locking out the original owner.) NOTE: this is unrelated to the graphql crate on crates.io.

Traduire en français

Produits concernés

stumpapp Stump

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.4 Moyenne	cve@mitre.org	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L`

Faiblesses (CWE)

CWE-863

Références

https://crates.io/crates/graphql
https://github.com/kashishtopi/stump-smartlist-bola
https://github.com/stumpapp/stump/blob/42a9918/crates/graphql/src/mutation/smart_lists.rs

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories