A flaw in Stumasy’s Note and Assignment Handlers allows a remote attacker to supply a crafted assignment_item_id value. Because the system omits a check that verifies the requester is authorized to perform operations on the specified item, the attacker can bypass authorization controls and manipulate or view notes they should not have access to. The weakness is classified as CWE-285 and CWE-639, indicating an authorization failure with the misuse of privileges.

All builds of Stumasy that precede the commit 327d1b0f2915ba79d7ef8ebb74553e987609d9be are affected. Specific release numbers are unknown due to the project’s continuous delivery model, so any instance of Stumasy prior to that commit is at risk until a patch is issued.

The CVSS v3 score of 6.9 indicates a moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. However, a public exploit exists, so the vulnerability can be leveraged remotely by manipulating the assignment_item_id parameter in the web interface. Because the vulnerability is not listed in CISA’s KEV catalog, it has not yet been confirmed as actively exploited, but the presence of a publicly available exploit requires vigilance.