{"id":"CVE-2026-127087","kind":"vulnerability","aliases":["CVE-2026-127087"],"related":[],"title":"Ryot: authenticated users can revoke other users' access links","description":"Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to revoke other users' access links by supplying an arbitrary accessLinkId. Attackers can obtain access link ids from public share URLs and revoke them without ownership checks, breaking shared access for all link users.","summary":"Ryot before 10.5.6 lets any logged-in user revoke other users' share links by supplying an arbitrary access link id. Attackers can get those ids from public share URLs, which breaks shared access for everyone using the link.","severity":"low","cvss":3.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","ryot","self-hosted"],"not_affected_if":["no-shared-links","version-10.5.6-or-later"],"how_to_check":"- Check the installed Ryot version and compare it with `10.5.6`.","fix":"- Ryot: upgrade to `10.5.6` or later.","status":"open","published_at":"2026-11-13T10:18:05+00:00","first_seen_at":"2026-11-13T10:47:29+00:00","triaged_at":"2026-11-13T10:58:56+00:00","updated_at":"2026-11-13T10:58:56+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T10:58:56Z","model":"claude-haiku-5-5","output":{"fix":"- Ryot: upgrade to `10.5.6` or later.","reach":"network","title":"Ryot: authenticated users can revoke other users' access links","impact":"low","summary":"Ryot before 10.5.6 lets any logged-in user revoke other users' share links by supplying an arbitrary access link id. Attackers can get those ids from public share URLs, which breaks shared access for everyone using the link.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ryot","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"other users' shared access links get revoked, breaking their access","analyst_note":"","how_to_check":"- Check the installed Ryot version and compare it with `10.5.6`.\n- unknown","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-10.5.6-or-later","no-shared-links"],"who_is_affected":"Ryot instances running a version before 10.5.6 that have users sharing access links. Exposure requires an authenticated account on the instance; instances without shared links or with a single user are unlikely to see impact.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000686,"input_tokens":4622,"output_tokens":448,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-127087':12A,15A '-2026':11A,14A '10.5.6':23B,62C 'access':8A,39B,54B,76C,86C,101C 'accesslinkid':82C 'allow':69C 'arbitrari':38B,81C 'attack':42B,83C 'authent':2A,70C 'author':65C 'break':52B,99C 'bypass':66C 'check':98C 'contain':63C 'cve':10A,13A 'everyon':56B 'get':44B 'host':20B 'id':41B,46B,88C 'let':24B 'link':9A,34B,40B,59B,77C,87C,104C 'log':27B 'logged-in':26B 'obtain':85C 'ownership':97C 'packag':16B 'public':48B,90C 'revok':5A,30B,73C,94C 'ryot':1A,17B,21B,60C 'self':19B 'self-host':18B 'share':33B,49B,53B,91C,100C 'suppli':36B,79C 'url':50B,92C 'use':57B 'user':3A,7A,29B,32B,71C,75C,105C 'vulner':67C 'without':96C","nicknames":[],"mitigations":[],"who_affected":"Ryot instances running a version before 10.5.6 that have users sharing access links. Exposure requires an authenticated account on the instance; instances without shared links or with a single user are unlikely to see impact.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["low","package","ryot","selfhosted"],"campaign_type":null,"search_a":"'-127087':12A,15A '-2026':11A,14A 'access':8A 'authent':2A 'cve':10A,13A 'link':9A 'revok':5A 'ryot':1A 'user':3A,7A","search_b":"'10.5.6':23B 'access':39B,54B 'arbitrari':38B 'attack':42B 'break':52B 'everyon':56B 'get':44B 'host':20B 'id':41B,46B 'let':24B 'link':34B,40B,59B 'log':27B 'logged-in':26B 'packag':16B 'public':48B 'revok':30B 'ryot':17B,21B 'self':19B 'self-host':18B 'share':33B,49B,53B 'suppli':36B 'url':50B 'use':57B 'user':29B,32B","search_c":"'10.5.6':62C 'access':76C,86C,101C 'accesslinkid':82C 'allow':69C 'arbitrari':81C 'attack':83C 'authent':70C 'author':65C 'break':99C 'bypass':66C 'check':98C 'contain':63C 'id':88C 'link':77C,87C,104C 'obtain':85C 'ownership':97C 'public':90C 'revok':73C,94C 'ryot':60C 'share':91C,100C 'suppli':79C 'url':92C 'user':71C,75C,105C 'vulner':67C 'without':96C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-01T05:25:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127087","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127087","severity":null,"published_at":"2026-11-13T10:18:05+00:00","modified_at":"2026-11-13T10:18:05+00:00","first_seen_at":"2026-11-13T10:47:29+00:00","fetched_at":"2026-11-13T10:47:29+00:00","note":null}],"documents":[{"id":90730,"url":"https://github.com/IgnisDa/ryot/commit/822cc6701b46aedbc436abbf02e7efb94afd5f05","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":90731,"url":"https://github.com/IgnisDa/ryot/releases/tag/v10.5.6","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":145308,"url":"https://github.com/IgnisDa/ryot/security/advisories/GHSA-9cwp-c4f6-rh6m","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-01T05:25:58+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145309,"url":"https://www.vulncheck.com/advisories/ryot-before-10.5.6-authorization-bypass-via-revokeaccesslink-graphql-mutation","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}