CVE-2026-14753
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
A vulnerability was found in mjperpinosa stumasy up to commit 327d1b0f2915ba79d7ef8ebb74553e987609d9be. An unknown function in /PHP/objects/notes within the Note Handler/Assignment Handler component allows authorization bypass via manipulation of the assignment_item_id argument. The attack is remotely exploitable and the exploit is public.
Risk Assessment
The organization faces remote authorization bypass, potentially leading to unauthorized access to data or system functions. The public exploit increases the risk of immediate exploitation.
Recommendation
Apply available patches immediately or temporarily disable the Note Handler/Assignment Handler component. Monitor the project repository for an official fix.
Other vulnerabilities in stumasy
See all- CVE-2026-14751Medium
A SQL injection vulnerability has been found in mjperpinosa stumasy up to commit 327d1b0f2915ba79d7ef8ebb74553e987609d9be in the Notes_controller::search_scratch_data function. The attack can be launched remotely by manipulating the field_name argument. The exploit is publicly available, increasing the risk of exploitation.
- CVE-2026-14749High
A vulnerability was found in mjperpinosa stumasy up to version 327d1b0f2915ba79d7ef8ebb74553e987609d9be in the eval function of calculate.php. Manipulating the mathematical_sentence argument allows remote code injection. The exploit is publicly available and may be used.
- CVE-2026-10807Medium
A vulnerability was found in mjperpinosa's stumasy application in an unknown function of the file application/PHP/objects/profiles/change_profile_image.php. Manipulating the pr_profile_image argument leads to unrestricted file upload. The attack can be launched remotely and the exploit has been publicly disclosed.
- CVE-2026-10806Medium
A vulnerability was found in mjperpinosa's stumasy application in an unknown function of the file application/PHP/objects/updates/add_post.php. Manipulating the up_file_to_post argument results in unrestricted file upload. The attack can be initiated remotely and the exploit has been made public.
Original NVD description (English source)
A vulnerability was detected in mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be. This impacts an unknown function of the file /PHP/objects/notes of the component Note Handler/Assignment Handler. Performing a manipulation of the argument assignment_item_id results in authorization bypass. The attack can be initiated remotely. The exploit is now public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.