---
id: "CVE-2026-127087"
page: "https://infrastack.ai/live/CVE-2026-127087"
kind: "vulnerability"
aliases: ["CVE-2026-127087"]
title: "Ryot: authenticated users can revoke other users' access links"
severity: "low"
cvss: 3.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "ryot", "self-hosted"]
not_affected_if: ["no-shared-links", "version-10.5.6-or-later"]
published_at: "2026-11-13T10:18:05+00:00"
first_seen_at: "2026-11-13T10:47:29+00:00"
updated_at: "2026-11-13T10:58:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-127087", "first_seen_at": "2026-11-13T10:47:29+00:00"}]
exploit_sources: []
---

# Ryot: authenticated users can revoke other users' access links

Link for people: https://infrastack.ai/live/CVE-2026-127087 (this .md is for agents)

Ryot before 10.5.6 lets any logged-in user revoke other users' share links by supplying an arbitrary access link id. Attackers can get those ids from public share URLs, which breaks shared access for everyone using the link.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Ryot version and compare it with `10.5.6`.

## Fix

- Ryot: upgrade to `10.5.6` or later.

## Timeline

- 2026-11-13T10:47:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-127087

## Documents

- [advisory] Vendor advisory: github.com https://github.com/IgnisDa/ryot/security/advisories/GHSA-9cwp-c4f6-rh6m
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/ryot-before-10.5.6-authorization-bypass-via-revokeaccesslink-graphql-mutation
- [fix] Patch: github.com https://github.com/IgnisDa/ryot/commit/822cc6701b46aedbc436abbf02e7efb94afd5f05
- [fix] Release notes: github.com https://github.com/IgnisDa/ryot/releases/tag/v10.5.6

## From the sources

Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to revoke other users' access links by supplying an arbitrary accessLinkId. Attackers can obtain access link ids from public share URLs and revoke them without ownership checks, breaking shared access for all link users.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_