Access Control Vulnerability in Stump API Affects Smart List Management
CVE-2026-107450
Key Information:
Badges
What is CVE-2026-107450?
In Stump API versions up to 0.1.10, a flaw exists in the GraphQL mutations for updating and deleting smart lists. These mutations rely solely on the shared AccessSmartList permission, neglecting to verify the creator's identity of the smart list. This oversight allows any authenticated user with the necessary permission to overwrite, delete, or assume control of another user's smart list. Specifically, the updateSmartList mutation can alter the creatorId to that of the caller, and can hide the list from the original owner by setting its visibility to PRIVATE. This situation can lead to significant data manipulation and privacy concerns for users.
Affected Version(s)
Stump 0 <= 0.1.10
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.