CVE-2026-127087 · Package
NO FIX YET · SEE WHAT TO DO
Ryot before 10.5.6 lets any logged-in user revoke other users' share links by supplying an arbitrary access link id. Attackers can get those ids from public share URLs, which breaks shared access for everyone using the link.
first public Nov 1, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Ryot instances running a version before 10.5.6 that have users sharing access links. Exposure requires an authenticated account on the instance; instances without shared links or with a single user are unlikely to see impact.
Not affected if no-shared-links, version-10.5.6-or-later
Who cares ryot, self-hosted
10.5.6.10.5.6 or later.Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to revoke other users' access links by supplying an arbitrary accessLinkId. Attackers can obtain access link ids from public share URLs and revoke them without ownership checks, breaking shared access for all link users.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.