CVE-2026-107450

Status: DeferredMedium (5.4)—

In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations (crates/graphql/src/mutation/smart_lists.rs) depend only on the shared AccessSmartList permission and resolve the target list at Reader access (lacking a creator check). Any authenticated user with that permission can overwrite, delete, or take over another user's smart list. (updateSmartList sets creatorId to the caller identity, and can set visibility to PRIVATE, locking out the original owner.) NOTE: this is unrelated to the graphql crate on crates.io.

CVSS

Version: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Base score: 5.4

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.21%
Percentile among all scored CVEs: 11
Score date: 10/17/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1210 Exploitation of Remote Serviceslateral movement85 %
Primary impactT1078 Valid Accountsstealth · persistence · privilege escalation · initial access80 %
Secondary impactT1565.001 Stored Data Manipulationimpact75 %

Acceso autenticado a servicios remotos (GraphQL) con PR:L sin validación de propiedad permite tomar control de listas ajenas. Impacto: secuestro de cuenta (T1078) y modificación de datos (T1565.001).

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Privileged Account Management Application Developer Guidance Active Directory Configuration Vulnerability Scanning User Training User Account Management

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Stump — Stump^AI

CWEs

CWE-863

References

Raw JSON (NVD)

Show

{
  "id": "CVE-2026-107450",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-107450",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-08T14:28:07.570884Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve@mitre.org",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "repo": "https://github.com/stumpapp/stump",
          "vendor": "stumpapp",
          "modules": [
            "GraphQL smart list mutations"
          ],
          "product": "Stump",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "0.1.10"
            }
          ],
          "programFiles": [
            "crates/graphql/src/mutation/smart_lists.rs"
          ],
          "defaultStatus": "unknown",
          "programRoutines": [
            {
              "name": "update_smart_list"
            },
            {
              "name": "delete_smart_list"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-08T05:17:04.477",
  "references": [
    {
      "url": "https://crates.io/crates/graphql",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/kashishtopi/stump-smartlist-bola",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/stumpapp/stump/blob/42a9918/crates/graphql/src/mutation/smart_lists.rs",
      "source": "cve@mitre.org"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@mitre.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations (crates/graphql/src/mutation/smart_lists.rs) depend only on the shared AccessSmartList permission and resolve the target list at Reader access (lacking a creator check). Any authenticated user with that permission can overwrite, delete, or take over another user's smart list. (updateSmartList sets creatorId to the caller identity, and can set visibility to PRIVATE, locking out the original owner.) NOTE: this is unrelated to the graphql crate on crates.io."
    }
  ],
  "lastModified": "2026-10-08T21:35:53.890",
  "sourceIdentifier": "cve@mitre.org"
}