PT-2026-107807

In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations crates/graphql/src/mutation/smart lists.rs depend only on the shared AccessSmartList permission and resolve the target list at Reader access lacking a creator check. Any authenticated user with that permission can...