EUVD-2026-94730
GHSA-2w7f-m7xm-pw66
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with AccessSmartList permission
-
DeliveryEnumerate victim's smart list ID
-
ExploitCall updateSmartList/deleteSmartList on target
-
ExecutionReassign creatorId and set visibility PRIVATE
-
ImpactLock out or destroy original owner's list
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated Stump account that holds the shared AccessSmartList permission (commonly granted to regular users), plus a multi-user instance so a victim list exists, and knowledge or enumeration of the target smart list's object ID. No special non-default configuration is needed - any Stump deployment at or below 0.1.10 where more than one user has AccessSmartList is affected. Limiting factors: single-user instances have no cross-user victim, and the attacker must already possess credentials and the permission, so exploitation is bounded to insiders or compromised accounts rather than anonymous remote attackers. |
| Impact | CVSS 8.1 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H indicates a low-complexity, network-reachable attack requiring only low privileges and no user interaction, with high integrity and availability impact. The flaw is a broken object-level authorization issue (CWE-863): the resolver trusts the shared AccessSmartList permission and resolves the target at Reader access without a creator/ownership check. Public exploit code exists (the stump-smartlist-bola PoC), which raises practical risk, but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation - the POC signal and exploitation-status signal are distinct and should not be conflated. The PR:L requirement is a meaningful limiter: an attacker needs a valid authenticated account already holding the (commonly shared) AccessSmartList permission, so the realistic threat is a malicious or compromised insider within a multi-user instance rather than an anonymous internet attacker. Net: a genuine, easily-exploited authorization bug worth patching on any multi-user deployment, but the niche product footprint and authentication prerequisite make it a targeted/insider concern rather than an internet-wide emergency. |
| Exploit ScenarioDerived | A low-privileged but authenticated Stump user holding the shared AccessSmartList permission enumerates another user's smart list ID and invokes the updateSmartList (or deleteSmartList) GraphQL mutation against it. Because only the shared permission is checked and ownership is never verified, the attacker reassigns creatorId to themselves and flips visibility to PRIVATE, hijacking or destroying the victim's list. A public proof-of-concept (github.com/kashishtopi/stump-smartlist-bola) demonstrates the technique. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Stump through 0.1.10 allows any authenticated user with the shared AccessSmartList permission to overwrite, delete, or take over other users' smart lists via vulnerable GraphQL mutations. The updateSmartList and deleteSmartList mutations lack a creator check, enabling attackers to set themselves as the new creator and change list visibility to PRIVATE, locking out the original owner. Publicly available exploit code exists, but exploitation requires a multi-user Stump instance and low-privileged credentials, limiting impact to insiders or compromised accounts.
RemediationAI
No vendor-released patch identified at time of analysis. To mitigate, administrators should immediately revoke the AccessSmartList permission from untrusted users, as the vulnerability requires this permission to exploit; however, this may break intended collaboration features for regular users. Alternatively, disable the smart lists feature entirely if not required, accepting the loss of functionality. For a comprehensive fix, apply a code patch to the vulnerable mutations to enforce a creator check before allowing update or delete operations, ensuring only the creator or an administrator can modify a list; this requires a custom build until an official patch is released. Monitor smart lists for unauthorized changes to creatorId or visibility set to PRIVATE, and audit logs for updateSmartList/deleteSmartList calls. A Web Application Firewall may be configured to block these GraphQL mutations from non-admin users, though parsing GraphQL reliably is challenging. Given the publicly available exploit code, prioritize these mitigations on multi-user instances.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in Stump's GraphQL API implementation, specifically in crates/graphql/src/mutation/smart_lists.rs, where the updateSmartList and deleteSmartList mutations enforce only the shared AccessSmartList permission and resolve the target list at Reader access level without verifying the caller is the list creator. This is a CWE-863 (Incorrect Authorization) flaw, enabling horizontal privilege escalation. The affected product is Stump (CPE cpe:2.3:a:stumpapp:stump:*:*:*:*:*:*:*:*), versions through 0.1.10. Note that this issue is unrelated to the graphql crate on crates.io. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) indicates network-reachable, low-complexity exploitation requiring low privileges and no user interaction, with high integrity and availability impact.
Know when Stump gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Network GraphQL API (AV:N) with no ownership check (AC:L/UI:N) abusable by a low-privileged authenticated user holding a shared permission (PR:L); overwrite/takeover gives I:H and delete/lockout gives A:H, with no data disclosure (C:N).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations (crates/graphql/src/mutation/smart_lists.rs) depend only on the shared AccessSmartList permission and resolve the target list at Reader access (lacking a creator check). Any authenticated user with that permission can overwrite, delete, or take over another user's smart list. (updateSmartList sets creatorId to the caller identity, and can set visibility to PRIVATE, locking out the original owner.) NOTE: this is unrelated to the graphql crate on crates.io.
Executive ViewAI
Stump, a self-hosted media server, exposes every user's personal smart lists to takeover, deletion, or covert privatization by anyone holding the shared AccessSmartList permission on a multi-user deployment. Although no vendor patch is currently available, the exposure is bounded to users on shared instances and requires low-privileged credentials, so the practical risk centers on insider misuse or abuse of compromised accounts rather than broad external attack. Leadership should care because loss or silent seizure of user-curated content undermines account trust and data integrity on any Stump instance used by multiple people or teams.
No vendor-released patch identified at time of analysis. Interim mitigations: revoke or minimize the AccessSmartList permission so only a small vetted set of accounts holds it; restrict deployment to single-user or invitation-only multi-user instances to shrink the affected population; capture and review GraphQL logs for updateSmartList and deleteSmartList mutations, especially creator-field changes and visibility set to PRIVATE; back up smart list data to enable restoration if lists are overwritten or deleted; and disable shared smart list functionality where operationally feasible until a fix is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB