CVE-2026-127085 · Package
NO FIX YET · SEE WHAT TO DO
Ryot before 10.5.6 lets any logged-in user remove entries from other users' collections by supplying arbitrary collection name and creator user id values. The attacker can list user ids through the usersList query and delete rows such as another user's Watchlist entries.
first public Nov 1, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any self-hosted Ryot instance before 10.5.6 with more than one account is exposed, since the attacker must be an authenticated user. Single-user instances are unlikely to be meaningfully affected. unknown whether managed hosting is in use.
Not affected if patched, single-user
Who cares ryot, self-hosted
10.5.6Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to remove entries from other users' collections by supplying arbitrary collectionName and creatorUserId values. Attackers can obtain user ids from the usersList query and target fixed collection names like Watchlist to delete collection_to_entity rows belonging to other users.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.