{"id":"CVE-2026-127085","kind":"vulnerability","aliases":["CVE-2026-127085"],"related":[],"title":"Ryot: authorization bypass lets users remove entries from other users' collections","description":"Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to remove entries from other users' collections by supplying arbitrary collectionName and creatorUserId values. Attackers can obtain user ids from the usersList query and target fixed collection names like Watchlist to delete collection_to_entity rows belonging to other users.","summary":"Ryot before 10.5.6 lets any logged-in user remove entries from other users' collections by supplying arbitrary collection name and creator user id values. The attacker can list user ids through the usersList query and delete rows such as another user's Watchlist entries.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","ryot","self-hosted"],"not_affected_if":["patched","single-user"],"how_to_check":"- Check the running Ryot version against the version in the fix section.\n- Confirm whether user accounts other than administrators can sign in to the instance.","fix":"- Ryot: `10.5.6`","status":"open","published_at":"2026-11-13T10:18:05+00:00","first_seen_at":"2026-11-13T10:47:29+00:00","triaged_at":"2026-11-13T10:57:06+00:00","updated_at":"2026-11-13T10:57:06+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T10:57:06Z","model":"claude-haiku-5-5","output":{"fix":"- Ryot: `10.5.6`","reach":"network","title":"Ryot: authorization bypass lets users remove entries from other users' collections","impact":"medium","summary":"Ryot before 10.5.6 lets any logged-in user remove entries from other users' collections by supplying arbitrary collection name and creator user id values. The attacker can list user ids through the usersList query and delete rows such as another user's Watchlist entries.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ryot","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"other users' collection entries get deleted by any account holder","analyst_note":"","how_to_check":"- Check the running Ryot version against the version in the fix section.\n- Confirm whether user accounts other than administrators can sign in to the instance.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["single-user","patched"],"who_is_affected":"Any self-hosted Ryot instance before 10.5.6 with more than one account is exposed, since the attacker must be an authenticated user. Single-user instances are unlikely to be meaningfully affected. unknown whether managed hosting is in use.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.0007,"input_tokens":4639,"output_tokens":473,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-127085':14A,17A '-2026':13A,16A '10.5.6':25B,70C 'allow':77C 'anoth':63B 'arbitrari':40B,89C 'attack':49B,94C 'authent':78C 'author':2A,73C 'belong':116C 'bypass':3A,74C 'collect':11A,37B,41B,86C,106C,112C 'collectionnam':90C 'contain':71C 'creator':44B 'creatoruserid':92C 'cve':12A,15A 'delet':59B,111C 'entiti':114C 'entri':7A,33B,67B,82C 'fix':105C 'host':22B 'id':46B,53B,98C 'let':4A,26B 'like':108C 'list':51B 'log':29B 'logged-in':28B 'name':42B,107C 'obtain':96C 'packag':18B 'queri':57B,102C 'remov':6A,32B,81C 'row':60B,115C 'ryot':1A,19B,23B,68C 'self':21B 'self-host':20B 'suppli':39B,88C 'target':104C 'user':5A,10A,31B,36B,45B,52B,64B,79C,85C,97C,119C 'userslist':56B,101C 'valu':47B,93C 'vulner':75C 'watchlist':66B,109C","nicknames":[],"mitigations":[],"who_affected":"Any self-hosted Ryot instance before 10.5.6 with more than one account is exposed, since the attacker must be an authenticated user. Single-user instances are unlikely to be meaningfully affected. unknown whether managed hosting is in use.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","ryot","selfhosted"],"campaign_type":null,"search_a":"'-127085':14A,17A '-2026':13A,16A 'author':2A 'bypass':3A 'collect':11A 'cve':12A,15A 'entri':7A 'let':4A 'remov':6A 'ryot':1A 'user':5A,10A","search_b":"'10.5.6':25B 'anoth':63B 'arbitrari':40B 'attack':49B 'collect':37B,41B 'creator':44B 'delet':59B 'entri':33B,67B 'host':22B 'id':46B,53B 'let':26B 'list':51B 'log':29B 'logged-in':28B 'name':42B 'packag':18B 'queri':57B 'remov':32B 'row':60B 'ryot':19B,23B 'self':21B 'self-host':20B 'suppli':39B 'user':31B,36B,45B,52B,64B 'userslist':56B 'valu':47B 'watchlist':66B","search_c":"'10.5.6':70C 'allow':77C 'arbitrari':89C 'attack':94C 'authent':78C 'author':73C 'belong':116C 'bypass':74C 'collect':86C,106C,112C 'collectionnam':90C 'contain':71C 'creatoruserid':92C 'delet':111C 'entiti':114C 'entri':82C 'fix':105C 'id':98C 'like':108C 'name':107C 'obtain':96C 'queri':102C 'remov':81C 'row':115C 'ryot':68C 'suppli':88C 'target':104C 'user':79C,85C,97C,119C 'userslist':101C 'valu':93C 'vulner':75C 'watchlist':109C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-01T05:26:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127085","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127085","severity":null,"published_at":"2026-11-13T10:18:05+00:00","modified_at":"2026-11-13T10:18:05+00:00","first_seen_at":"2026-11-13T10:47:29+00:00","fetched_at":"2026-11-13T10:47:29+00:00","note":null}],"documents":[{"id":90730,"url":"https://github.com/IgnisDa/ryot/commit/822cc6701b46aedbc436abbf02e7efb94afd5f05","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":90731,"url":"https://github.com/IgnisDa/ryot/releases/tag/v10.5.6","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":145300,"url":"https://github.com/IgnisDa/ryot/security/advisories/GHSA-qwh4-gwr7-95x8","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-01T05:26:17+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145301,"url":"https://www.vulncheck.com/advisories/ryot-before-10.5.6-authorization-bypass-via-deployremoveentitiesfromcollectionjob","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}