---
id: "CVE-2026-127085"
page: "https://infrastack.ai/live/CVE-2026-127085"
kind: "vulnerability"
aliases: ["CVE-2026-127085"]
title: "Ryot: authorization bypass lets users remove entries from other users' collections"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "ryot", "self-hosted"]
not_affected_if: ["patched", "single-user"]
published_at: "2026-11-13T10:18:05+00:00"
first_seen_at: "2026-11-13T10:47:29+00:00"
updated_at: "2026-11-13T10:57:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-127085", "first_seen_at": "2026-11-13T10:47:29+00:00"}]
exploit_sources: []
---

# Ryot: authorization bypass lets users remove entries from other users' collections

Link for people: https://infrastack.ai/live/CVE-2026-127085 (this .md is for agents)

Ryot before 10.5.6 lets any logged-in user remove entries from other users' collections by supplying arbitrary collection name and creator user id values. The attacker can list user ids through the usersList query and delete rows such as another user's Watchlist entries.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the running Ryot version against the version in the fix section.
- Confirm whether user accounts other than administrators can sign in to the instance.

## Fix

- Ryot: `10.5.6`

## Timeline

- 2026-11-13T10:47:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-127085

## Documents

- [advisory] Vendor advisory: github.com https://github.com/IgnisDa/ryot/security/advisories/GHSA-qwh4-gwr7-95x8
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/ryot-before-10.5.6-authorization-bypass-via-deployremoveentitiesfromcollectionjob
- [fix] Patch: github.com https://github.com/IgnisDa/ryot/commit/822cc6701b46aedbc436abbf02e7efb94afd5f05
- [fix] Release notes: github.com https://github.com/IgnisDa/ryot/releases/tag/v10.5.6

## From the sources

Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to remove entries from other users' collections by supplying arbitrary collectionName and creatorUserId values. Attackers can obtain user ids from the usersList query and target fixed collection names like Watchlist to delete collection_to_entity rows belonging to other users.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_