CVE-2026-127086 · Package
NO FIX YET · SEE WHAT TO DO
Ryot before 10.5.6 lets any logged-in user pass an updateId to the createOrUpdateCollection GraphQL mutation and reassign a collection they do not own. An attacker who knows a collection id can read its items, rewrite its metadata, and remove the original owner and collaborators.
first public Nov 1, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted Ryot instances running a version below 10.5.6 where users have accounts. The attacker must be logged in and must know a target collection id. Instances on 10.5.6 or later are not affected.
Not affected if single-user-instance, version-10.5.6-or-later
Who cares graphql, ryot, self-hosted
10.5.6.10.5.6 or later.Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to take over other users' collections by supplying an updateId to the createOrUpdateCollection GraphQL mutation. Attackers who know a collection id can trigger ownership reassignment without checks, read its items, rewrite metadata, and evict the original owner and collaborators.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.