CVE-2026-14753: Authorization Bypass in mjperpinosa stumasy Note Handler

Technical summary

CVE-2026-14753 is an authorization bypass vulnerability (CVSS 7.3 HIGH) stemming from improper access control in mjperpinosa stumasy. The root causes map to CWE-285 (Improper Authorization) and CWE-639 (Authorization Bypass Through User-Controlled Key), indicating that the application fails to properly validate whether a user has permission to act on a given assignment_item_id parameter. The vulnerability resides in the Note Handler/Assignment Handler logic within /PHP/objects/notes. The attack vector is network-based with no authentication or user interaction required, making it straightforward to weaponize. The project uses continuous delivery with rolling releases, meaning version granularity is absent from public tracking.

Business impact

Exploitation enables attackers to read, modify, or delete notes and assignments they are not authorized to access. In a typical business context, this could expose sensitive meeting notes, confidential project assignments, personnel information, or customer records. The authorization bypass also risks data integrity—unauthorized edits could corrupt assignment workflows or plant false information. For organizations relying on this tool for secure collaboration or task management, the vulnerability undermines the core security model. Reputational damage may follow if customer or employee data is accessed without consent.

Affected systems

mjperpinosa stumasy up to commit 327d1b0f2915ba79d7ef8ebb74553e987609d9be is affected. The project uses rolling releases with continuous delivery, so no stable version numbers are published. Determine your deployment's commit hash by checking your local installation or repository history. If you are running any version prior to the reported commit and have not applied a fix, your system is at risk.

Exploitability

This vulnerability is highly exploitable in real-world scenarios. The attack requires only network access and a valid or guessable assignment_item_id—no authentication, no special privileges, and no user interaction. Public exploit code is now available, lowering the bar for attackers. The flaw's simplicity (parameter manipulation) and high accessibility mean it will likely be incorporated into attack toolkits and scanning engines quickly. Organizations should assume active exploitation is occurring or will occur soon.

Remediation

Contact the mjperpinosa stumasy project maintainers for patch guidance, as the vulnerability has been reported but no fix has been publicly released or versioned yet. In the interim, implement compensating controls: restrict network access to the /PHP/objects/notes endpoint via firewall rules or WAF policies, disable the Note Handler/Assignment Handler feature if unused, and enforce strict input validation on all assignment_item_id parameters. Monitor access logs for suspicious assignment_item_id values or patterns indicating enumeration attempts.

Patch guidance

Verify the project's issue tracker or advisory for available patches. Given the rolling-release model, patches may be committed to the main branch without a formal version bump. To confirm you are patched, verify your deployment commit hash against the reported vulnerable commit (327d1b0f2915ba79d7ef8ebb74553e987609d9be) and any subsequent commits addressing CWE-285/CWE-639 remediation. Enable automatic updates if available through the project's release mechanisms.

Detection guidance

Monitor logs for repeated or sequential access attempts to /PHP/objects/notes with varying assignment_item_id parameter values, especially from a single source or without corresponding authentication events. Look for access patterns that suggest enumeration (e.g., incrementing or random assignment_item_id values). Deploy a WAF rule to flag assignment_item_id parameters that do not match the authenticated user's expected ownership or role context. Intrusion detection systems should flag network-based requests to this endpoint from untrusted sources.

Why prioritize this

This vulnerability warrants immediate attention due to its combination of ease of exploitation, public availability of exploit information, lack of an available patch, and direct exposure of sensitive business data. The CVSS 7.3 HIGH score reflects the network accessibility and multi-faceted impact (confidentiality, integrity, availability). For any organization using mjperpinosa stumasy in production, this should be treated as a critical incident requiring urgent mitigation planning.

Risk score, explained

The CVSS 7.3 score (HIGH severity) reflects: Network attack vector (AV:N) requiring no special network privileges; Low complexity (AC:L) attack that does not require exploitation conditions beyond parameter manipulation; No authentication required (PR:N); No user interaction needed (UI:N); Unchanged scope (S:U); and partial impact to confidentiality, integrity, and availability (C:L/I:L/A:L). The score appropriately captures the seriousness of an unauthenticated, remotely exploitable authorization bypass with moderate data exposure and system disruption potential. The availability of public exploits elevates practical risk beyond the base score.

Frequently asked questions