A flaw in the Stump application allows any authenticated user with the AccessSmartList permission to overwrite, delete, or replace another user's smart list. The vulnerability exists because the GraphQL update and delete mutations rely only on a shared permission and resolve the target list with read access, without verifying that the caller is the creator. Consequently, an attacker can set the creatorId to their own identity, switch visibility to PRIVATE, and effectively take ownership of the list while locking out the original owner. The issue requires valid authentication and the AccessSmartList permission, but does not require additional privileges or network-level exposure. An attacker can exploit the flaw by calling the updateSmartList or deleteSmartList mutation through the GraphQL API, which is typically exposed to authenticated users. The CVSS score of 5.4 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that no widespread public exploits have been reported. However, the required permission is common in many deployments, so the risk of exploitation may increase in environments where users are granted broad AccessSmartList rights. The primary impact is the ability to tamper with or erase another user's data, potentially causing loss of sensitive information.

The affected product is the Rust library \"stump\" from the vendor stumpapp, in versions up to 0.1.10. Users deploying Stump at or below this version are vulnerable. Any server instance exposing the GraphQL API with the relevant mutations is susceptible, regardless of the environment.

Because the flaw is driven by GraphQL mutations, the attacker must be authenticated and possess the AccessSmartList permission. The vulnerability is not network-bounded; it can be triggered from any client with access to the API. The moderate CVSS score reflects the need for elevated permissions, yet the lack of a restriction on the target list gives attackers significant damage potential. Without a publicly known exploit, the EPSS score is unavailable, but the presence of the vulnerability in the keystone package and the broad grant of AccessSmartList calls for proactive mitigation.