CVE-2026-119800 · Package
NO FIX YET · SEE WHAT TO DO
Ryot, a self-hosted personal tracking app, lets any authenticated user request another user's collection by its id and get back the owner's identity, collection name, description, reviews and full item list. An attacker with an account and a collection id can read data that belongs to someone else on the same instance.
first public Nov 1, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Self-hosted Ryot instances older than 10.5.6 that have more than one user account. The flaw requires a valid login; a single-user instance has no other tenant's collections to expose. Instances already on 10.5.6 or later are not affected.
Not affected if single-user, version-10.5.6-or-later
Who cares graphql, ryot, self-hosted
10.5.6.10.5.6 or later.Ryot is a self-hosted personal tracking application. Prior to 10.5.6, the collectionContents GraphQL query implemented by collection_contents() in crates/services/collection/src/content_operations.rs accepts a caller-controlled CollectionContentsInput.collection_id and returns a collection without checking whether the authenticated user owns it, collaborates on it, or may view it. The caller's user id is used only to annotate the response, allowing any authenticated user who obtains another collection's id to read the owner's identity, collection name and description, reviews, and complete item list across the tenant boundary. This issue is fixed in version 10.5.6.
This page as ·
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.