Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-127087 (GCVE-0-2026-127087)

Vulnerability from nvd – Published: 2026-11-13 09:34 – Updated: 2026-11-13 09:34

Title

Ryot before 10.5.6 Authorization Bypass via revokeAccessLink GraphQL Mutation

Summary

Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to revoke other users' access links by supplying an arbitrary accessLinkId. Attackers can obtain access link ids from public share URLs and revoke them without ownership checks, breaking shared access for all link users.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8191 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/IgnisDa/ryot/security/advisori…	vendor-advisory
https://github.com/IgnisDa/ryot/commit/822cc6701b…	patch
https://github.com/IgnisDa/ryot/releases/tag/v10.5.6	release-notes
https://github.com/IgnisDa/ryot/blob/v10.5.5/crat…	technical-description
https://www.vulncheck.com/advisories/ryot-before-…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
IgnisDa	ryot	Affected: 0 , < 10.5.6 (semver)

Date Public

2026-11-01 05:25

Credits

Sandipkumar sah

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/IgnisDa/ryot",
          "product": "ryot",
          "repo": "https://github.com/IgnisDa/ryot",
          "vendor": "IgnisDa",
          "versions": [
            {
              "lessThan": "10.5.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Sandipkumar sah"
        }
      ],
      "datePublic": "2026-11-01T05:25:58.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to revoke other users\u0027 access links by supplying an arbitrary accessLinkId. Attackers can obtain access link ids from public share URLs and revoke them without ownership checks, breaking shared access for all link users."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T09:34:16.780Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-9cwp-c4f6-rh6m)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/IgnisDa/ryot/security/advisories/GHSA-9cwp-c4f6-rh6m"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/IgnisDa/ryot/commit/822cc6701b46aedbc436abbf02e7efb94afd5f05"
        },
        {
          "name": "Ryot v10.5.6 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/IgnisDa/ryot/releases/tag/v10.5.6"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/IgnisDa/ryot/blob/v10.5.5/crates/utils/database/src/lib.rs#L34-L45"
        },
        {
          "name": "VulnCheck Advisory: Ryot before 10.5.6 Authorization Bypass via revokeAccessLink GraphQL Mutation",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/ryot-before-10.5.6-authorization-bypass-via-revokeaccesslink-graphql-mutation"
        }
      ],
      "title": "Ryot before 10.5.6 Authorization Bypass via revokeAccessLink GraphQL Mutation",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-127087",
    "datePublished": "2026-11-13T09:34:16.780Z",
    "dateReserved": "2026-11-12T14:14:21.684Z",
    "dateUpdated": "2026-11-13T09:34:16.780Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-127086 (GCVE-0-2026-127086)

Vulnerability from nvd – Published: 2026-11-13 09:34 – Updated: 2026-11-13 09:34

Title

Ryot before 10.5.6 Authorization Bypass via createOrUpdateCollection updateId

Summary

Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to take over other users' collections by supplying an updateId to the createOrUpdateCollection GraphQL mutation. Attackers who know a collection id can trigger ownership reassignment without checks, read its items, rewrite metadata, and evict the original owner and collaborators.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8191 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/IgnisDa/ryot/security/advisori…	vendor-advisory
https://github.com/IgnisDa/ryot/commit/822cc6701b…	patch
https://github.com/IgnisDa/ryot/releases/tag/v10.5.6	release-notes
https://github.com/IgnisDa/ryot/blob/v10.5.5/crat…	technical-description
https://www.vulncheck.com/advisories/ryot-before-…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
IgnisDa	ryot	Affected: 0 , < 10.5.6 (semver)

Date Public

2026-11-01 05:26

Credits

Sandipkumar sah

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/IgnisDa/ryot",
          "product": "ryot",
          "repo": "https://github.com/IgnisDa/ryot",
          "vendor": "IgnisDa",
          "versions": [
            {
              "lessThan": "10.5.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Sandipkumar sah"
        }
      ],
      "datePublic": "2026-11-01T05:26:46.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to take over other users\u0027 collections by supplying an updateId to the createOrUpdateCollection GraphQL mutation. Attackers who know a collection id can trigger ownership reassignment without checks, read its items, rewrite metadata, and evict the original owner and collaborators."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T09:34:17.416Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-9v6w-g6x6-p4m5)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/IgnisDa/ryot/security/advisories/GHSA-9v6w-g6x6-p4m5"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/IgnisDa/ryot/commit/822cc6701b46aedbc436abbf02e7efb94afd5f05"
        },
        {
          "name": "Ryot v10.5.6 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/IgnisDa/ryot/releases/tag/v10.5.6"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/IgnisDa/ryot/blob/v10.5.5/crates/utils/dependent/collection/src/lib.rs#L137-L200"
        },
        {
          "name": "VulnCheck Advisory: Ryot before 10.5.6 Authorization Bypass via createOrUpdateCollection updateId",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/ryot-before-10.5.6-authorization-bypass-via-createorupdatecollection-updateid"
        }
      ],
      "title": "Ryot before 10.5.6 Authorization Bypass via createOrUpdateCollection updateId",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-127086",
    "datePublished": "2026-11-13T09:34:17.416Z",
    "dateReserved": "2026-11-12T14:14:21.333Z",
    "dateUpdated": "2026-11-13T09:34:17.416Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-127085 (GCVE-0-2026-127085)

Vulnerability from nvd – Published: 2026-11-13 09:34 – Updated: 2026-11-13 18:18

Title

Ryot before 10.5.6 Authorization Bypass via deployRemoveEntitiesFromCollectionJob

Summary

Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to remove entries from other users' collections by supplying arbitrary collectionName and creatorUserId values. Attackers can obtain user ids from the usersList query and target fixed collection names like Watchlist to delete collection_to_entity rows belonging to other users.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-13 18:17 UTC

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8191 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/IgnisDa/ryot/security/advisori…	vendor-advisory
https://github.com/IgnisDa/ryot/commit/822cc6701b…	patch
https://github.com/IgnisDa/ryot/releases/tag/v10.5.6	release-notes
https://github.com/IgnisDa/ryot/blob/v10.5.5/crat…	technical-description
https://www.vulncheck.com/advisories/ryot-before-…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
IgnisDa	ryot	Affected: 0 , < 10.5.6 (semver)

Date Public

2026-11-01 05:26

Credits

Sandipkumar sah

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-127085",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-13T18:17:44.374719Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-13T18:18:42.440Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/IgnisDa/ryot/security/advisories/GHSA-qwh4-gwr7-95x8"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/IgnisDa/ryot",
          "product": "ryot",
          "repo": "https://github.com/IgnisDa/ryot",
          "vendor": "IgnisDa",
          "versions": [
            {
              "lessThan": "10.5.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Sandipkumar sah"
        }
      ],
      "datePublic": "2026-11-01T05:26:17.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to remove entries from other users\u0027 collections by supplying arbitrary collectionName and creatorUserId values. Attackers can obtain user ids from the usersList query and target fixed collection names like Watchlist to delete collection_to_entity rows belonging to other users."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T09:34:18.133Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-qwh4-gwr7-95x8)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/IgnisDa/ryot/security/advisories/GHSA-qwh4-gwr7-95x8"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/IgnisDa/ryot/commit/822cc6701b46aedbc436abbf02e7efb94afd5f05"
        },
        {
          "name": "Ryot v10.5.6 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/IgnisDa/ryot/releases/tag/v10.5.6"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/IgnisDa/ryot/blob/v10.5.5/crates/utils/dependent/collection/src/lib.rs#L232-L251"
        },
        {
          "name": "VulnCheck Advisory: Ryot before 10.5.6 Authorization Bypass via deployRemoveEntitiesFromCollectionJob",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/ryot-before-10.5.6-authorization-bypass-via-deployremoveentitiesfromcollectionjob"
        }
      ],
      "title": "Ryot before 10.5.6 Authorization Bypass via deployRemoveEntitiesFromCollectionJob",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-127085",
    "datePublished": "2026-11-13T09:34:18.133Z",
    "dateReserved": "2026-11-12T14:14:20.971Z",
    "dateUpdated": "2026-11-13T18:18:42.440Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-77442 (GCVE-0-2026-77442)

Vulnerability from nvd – Published: 2026-11-06 21:26 – Updated: 2026-11-09 13:29

Title

Ryot: `createOrUpdateUserIntegration` trusts a client-supplied `integrationId` with no ownership check, letting any user hijack/overwrite another user's integration (cross-tenant IDOR)

Summary

Ryot is a self-hosted personal tracking application. Prior to 10.4.0, the createOrUpdateUserIntegration GraphQL mutation in crates/services/user/src/integration_operations.rs allows a low-privileged authenticated user to supply another user's integrationId to create_or_update_user_integration() without an ownership check. SeaORM treats the supplied primary key as an update target, and the operation assigns the caller's user_id while replacing the targeted integration's provider_specifics and other configuration, which can transfer ownership, overwrite configuration, or disable the victim's integration. Exploitation requires obtaining the victim's non-brute-forceable integration id, and the vulnerable update does not disclose existing stored credential values. This issue is fixed in version 10.4.0.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-09 13:28 UTC

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key
CWE-862 - Missing Authorization

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7886 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/IgnisDa/ryot/security/advisori…	x_refsource_CONFIRM
https://github.com/IgnisDa/ryot/pull/1797	x_refsource_MISC
https://github.com/IgnisDa/ryot/commit/c4dffc68fc…	x_refsource_MISC
https://github.com/IgnisDa/ryot/releases/tag/v10.4.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
IgnisDa	ryot	Affected: < 10.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77442",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T13:28:42.830777Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T13:29:06.702Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/IgnisDa/ryot/security/advisories/GHSA-cjxv-jj8g-vfvj"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ryot",
          "vendor": "IgnisDa",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 10.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Ryot is a self-hosted personal tracking application. Prior to 10.4.0, the createOrUpdateUserIntegration GraphQL mutation in crates/services/user/src/integration_operations.rs allows a low-privileged authenticated user to supply another user\u0027s integrationId to create_or_update_user_integration() without an ownership check. SeaORM treats the supplied primary key as an update target, and the operation assigns the caller\u0027s user_id while replacing the targeted integration\u0027s provider_specifics and other configuration, which can transfer ownership, overwrite configuration, or disable the victim\u0027s integration. Exploitation requires obtaining the victim\u0027s non-brute-forceable integration id, and the vulnerable update does not disclose existing stored credential values. This issue is fixed in version 10.4.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T21:26:52.401Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/IgnisDa/ryot/security/advisories/GHSA-cjxv-jj8g-vfvj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/IgnisDa/ryot/security/advisories/GHSA-cjxv-jj8g-vfvj"
        },
        {
          "name": "https://github.com/IgnisDa/ryot/pull/1797",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/IgnisDa/ryot/pull/1797"
        },
        {
          "name": "https://github.com/IgnisDa/ryot/commit/c4dffc68fc0aaf65b65c520d1d45d8da52ea8606",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/IgnisDa/ryot/commit/c4dffc68fc0aaf65b65c520d1d45d8da52ea8606"
        },
        {
          "name": "https://github.com/IgnisDa/ryot/releases/tag/v10.4.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/IgnisDa/ryot/releases/tag/v10.4.0"
        }
      ],
      "source": {
        "advisory": "GHSA-cjxv-jj8g-vfvj",
        "discovery": "UNKNOWN"
      },
      "title": "Ryot: `createOrUpdateUserIntegration` trusts a client-supplied `integrationId` with no ownership check, letting any user hijack/overwrite another user\u0027s integration (cross-tenant IDOR)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-77442",
    "datePublished": "2026-11-06T21:26:52.401Z",
    "dateReserved": "2026-08-20T19:59:59.605Z",
    "dateUpdated": "2026-11-09T13:29:06.702Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-119800 (GCVE-0-2026-119800)

Vulnerability from nvd – Published: 2026-11-06 21:29 – Updated: 2026-11-09 22:42

Title

Ryot: Cross-tenant collection read via `collectionContents`

Summary

Ryot is a self-hosted personal tracking application. Prior to 10.5.6, the collectionContents GraphQL query implemented by collection_contents() in crates/services/collection/src/content_operations.rs accepts a caller-controlled CollectionContentsInput.collection_id and returns a collection without checking whether the authenticated user owns it, collaborates on it, or may view it. The caller's user id is used only to annotate the response, allowing any authenticated user who obtains another collection's id to read the owner's identity, collection name and description, reviews, and complete item list across the tenant boundary. This issue is fixed in version 10.5.6.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-09 22:35 UTC

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7886 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/IgnisDa/ryot/security/advisori…	x_refsource_CONFIRM
https://github.com/IgnisDa/ryot/pull/1870	x_refsource_MISC
https://github.com/IgnisDa/ryot/commit/822cc6701b…	x_refsource_MISC
https://github.com/IgnisDa/ryot/releases/tag/v10.5.6	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
IgnisDa	ryot	Affected: < 10.5.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119800",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T22:35:16.005330Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T22:42:32.872Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ryot",
          "vendor": "IgnisDa",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 10.5.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Ryot is a self-hosted personal tracking application. Prior to 10.5.6, the collectionContents GraphQL query implemented by collection_contents() in crates/services/collection/src/content_operations.rs accepts a caller-controlled CollectionContentsInput.collection_id and returns a collection without checking whether the authenticated user owns it, collaborates on it, or may view it. The caller\u0027s user id is used only to annotate the response, allowing any authenticated user who obtains another collection\u0027s id to read the owner\u0027s identity, collection name and description, reviews, and complete item list across the tenant boundary. This issue is fixed in version 10.5.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T21:29:32.910Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/IgnisDa/ryot/security/advisories/GHSA-pv32-9hxm-ph4v",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/IgnisDa/ryot/security/advisories/GHSA-pv32-9hxm-ph4v"
        },
        {
          "name": "https://github.com/IgnisDa/ryot/pull/1870",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/IgnisDa/ryot/pull/1870"
        },
        {
          "name": "https://github.com/IgnisDa/ryot/commit/822cc6701b46aedbc436abbf02e7efb94afd5f05",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/IgnisDa/ryot/commit/822cc6701b46aedbc436abbf02e7efb94afd5f05"
        },
        {
          "name": "https://github.com/IgnisDa/ryot/releases/tag/v10.5.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/IgnisDa/ryot/releases/tag/v10.5.6"
        }
      ],
      "source": {
        "advisory": "GHSA-pv32-9hxm-ph4v",
        "discovery": "UNKNOWN"
      },
      "title": "Ryot: Cross-tenant collection read via `collectionContents`"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-119800",
    "datePublished": "2026-11-06T21:29:32.910Z",
    "dateReserved": "2026-10-30T16:28:37.900Z",
    "dateUpdated": "2026-11-09T22:42:32.872Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-127085 (GCVE-0-2026-127085)

Vulnerability from cvelistv5 – Published: 2026-11-13 09:34 – Updated: 2026-11-13 18:18

Title

Ryot before 10.5.6 Authorization Bypass via deployRemoveEntitiesFromCollectionJob

Summary

Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to remove entries from other users' collections by supplying arbitrary collectionName and creatorUserId values. Attackers can obtain user ids from the usersList query and target fixed collection names like Watchlist to delete collection_to_entity rows belonging to other users.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-13 18:17 UTC

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8191 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/IgnisDa/ryot/security/advisori…	vendor-advisory
https://github.com/IgnisDa/ryot/commit/822cc6701b…	patch
https://github.com/IgnisDa/ryot/releases/tag/v10.5.6	release-notes
https://github.com/IgnisDa/ryot/blob/v10.5.5/crat…	technical-description
https://www.vulncheck.com/advisories/ryot-before-…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
IgnisDa	ryot	Affected: 0 , < 10.5.6 (semver)

Date Public

2026-11-01 05:26

Credits

Sandipkumar sah

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-127085",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-13T18:17:44.374719Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-13T18:18:42.440Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/IgnisDa/ryot/security/advisories/GHSA-qwh4-gwr7-95x8"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/IgnisDa/ryot",
          "product": "ryot",
          "repo": "https://github.com/IgnisDa/ryot",
          "vendor": "IgnisDa",
          "versions": [
            {
              "lessThan": "10.5.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Sandipkumar sah"
        }
      ],
      "datePublic": "2026-11-01T05:26:17.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to remove entries from other users\u0027 collections by supplying arbitrary collectionName and creatorUserId values. Attackers can obtain user ids from the usersList query and target fixed collection names like Watchlist to delete collection_to_entity rows belonging to other users."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T09:34:18.133Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-qwh4-gwr7-95x8)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/IgnisDa/ryot/security/advisories/GHSA-qwh4-gwr7-95x8"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/IgnisDa/ryot/commit/822cc6701b46aedbc436abbf02e7efb94afd5f05"
        },
        {
          "name": "Ryot v10.5.6 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/IgnisDa/ryot/releases/tag/v10.5.6"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/IgnisDa/ryot/blob/v10.5.5/crates/utils/dependent/collection/src/lib.rs#L232-L251"
        },
        {
          "name": "VulnCheck Advisory: Ryot before 10.5.6 Authorization Bypass via deployRemoveEntitiesFromCollectionJob",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/ryot-before-10.5.6-authorization-bypass-via-deployremoveentitiesfromcollectionjob"
        }
      ],
      "title": "Ryot before 10.5.6 Authorization Bypass via deployRemoveEntitiesFromCollectionJob",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-127085",
    "datePublished": "2026-11-13T09:34:18.133Z",
    "dateReserved": "2026-11-12T14:14:20.971Z",
    "dateUpdated": "2026-11-13T18:18:42.440Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-127086 (GCVE-0-2026-127086)

Vulnerability from cvelistv5 – Published: 2026-11-13 09:34 – Updated: 2026-11-13 09:34

Title

Ryot before 10.5.6 Authorization Bypass via createOrUpdateCollection updateId

Summary

Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to take over other users' collections by supplying an updateId to the createOrUpdateCollection GraphQL mutation. Attackers who know a collection id can trigger ownership reassignment without checks, read its items, rewrite metadata, and evict the original owner and collaborators.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8191 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/IgnisDa/ryot/security/advisori…	vendor-advisory
https://github.com/IgnisDa/ryot/commit/822cc6701b…	patch
https://github.com/IgnisDa/ryot/releases/tag/v10.5.6	release-notes
https://github.com/IgnisDa/ryot/blob/v10.5.5/crat…	technical-description
https://www.vulncheck.com/advisories/ryot-before-…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
IgnisDa	ryot	Affected: 0 , < 10.5.6 (semver)

Date Public

2026-11-01 05:26

Credits

Sandipkumar sah

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/IgnisDa/ryot",
          "product": "ryot",
          "repo": "https://github.com/IgnisDa/ryot",
          "vendor": "IgnisDa",
          "versions": [
            {
              "lessThan": "10.5.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Sandipkumar sah"
        }
      ],
      "datePublic": "2026-11-01T05:26:46.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to take over other users\u0027 collections by supplying an updateId to the createOrUpdateCollection GraphQL mutation. Attackers who know a collection id can trigger ownership reassignment without checks, read its items, rewrite metadata, and evict the original owner and collaborators."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T09:34:17.416Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-9v6w-g6x6-p4m5)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/IgnisDa/ryot/security/advisories/GHSA-9v6w-g6x6-p4m5"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/IgnisDa/ryot/commit/822cc6701b46aedbc436abbf02e7efb94afd5f05"
        },
        {
          "name": "Ryot v10.5.6 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/IgnisDa/ryot/releases/tag/v10.5.6"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/IgnisDa/ryot/blob/v10.5.5/crates/utils/dependent/collection/src/lib.rs#L137-L200"
        },
        {
          "name": "VulnCheck Advisory: Ryot before 10.5.6 Authorization Bypass via createOrUpdateCollection updateId",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/ryot-before-10.5.6-authorization-bypass-via-createorupdatecollection-updateid"
        }
      ],
      "title": "Ryot before 10.5.6 Authorization Bypass via createOrUpdateCollection updateId",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-127086",
    "datePublished": "2026-11-13T09:34:17.416Z",
    "dateReserved": "2026-11-12T14:14:21.333Z",
    "dateUpdated": "2026-11-13T09:34:17.416Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-127087 (GCVE-0-2026-127087)

Vulnerability from cvelistv5 – Published: 2026-11-13 09:34 – Updated: 2026-11-13 09:34

Title

Ryot before 10.5.6 Authorization Bypass via revokeAccessLink GraphQL Mutation

Summary

Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to revoke other users' access links by supplying an arbitrary accessLinkId. Attackers can obtain access link ids from public share URLs and revoke them without ownership checks, breaking shared access for all link users.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 8191 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/IgnisDa/ryot/security/advisori…	vendor-advisory
https://github.com/IgnisDa/ryot/commit/822cc6701b…	patch
https://github.com/IgnisDa/ryot/releases/tag/v10.5.6	release-notes
https://github.com/IgnisDa/ryot/blob/v10.5.5/crat…	technical-description
https://www.vulncheck.com/advisories/ryot-before-…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
IgnisDa	ryot	Affected: 0 , < 10.5.6 (semver)

Date Public

2026-11-01 05:25

Credits

Sandipkumar sah

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/IgnisDa/ryot",
          "product": "ryot",
          "repo": "https://github.com/IgnisDa/ryot",
          "vendor": "IgnisDa",
          "versions": [
            {
              "lessThan": "10.5.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Sandipkumar sah"
        }
      ],
      "datePublic": "2026-11-01T05:25:58.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to revoke other users\u0027 access links by supplying an arbitrary accessLinkId. Attackers can obtain access link ids from public share URLs and revoke them without ownership checks, breaking shared access for all link users."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-13T09:34:16.780Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-9cwp-c4f6-rh6m)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/IgnisDa/ryot/security/advisories/GHSA-9cwp-c4f6-rh6m"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/IgnisDa/ryot/commit/822cc6701b46aedbc436abbf02e7efb94afd5f05"
        },
        {
          "name": "Ryot v10.5.6 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/IgnisDa/ryot/releases/tag/v10.5.6"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/IgnisDa/ryot/blob/v10.5.5/crates/utils/database/src/lib.rs#L34-L45"
        },
        {
          "name": "VulnCheck Advisory: Ryot before 10.5.6 Authorization Bypass via revokeAccessLink GraphQL Mutation",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/ryot-before-10.5.6-authorization-bypass-via-revokeaccesslink-graphql-mutation"
        }
      ],
      "title": "Ryot before 10.5.6 Authorization Bypass via revokeAccessLink GraphQL Mutation",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-127087",
    "datePublished": "2026-11-13T09:34:16.780Z",
    "dateReserved": "2026-11-12T14:14:21.684Z",
    "dateUpdated": "2026-11-13T09:34:16.780Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-119800 (GCVE-0-2026-119800)

Vulnerability from cvelistv5 – Published: 2026-11-06 21:29 – Updated: 2026-11-09 22:42

Title

Ryot: Cross-tenant collection read via `collectionContents`

Summary

Ryot is a self-hosted personal tracking application. Prior to 10.5.6, the collectionContents GraphQL query implemented by collection_contents() in crates/services/collection/src/content_operations.rs accepts a caller-controlled CollectionContentsInput.collection_id and returns a collection without checking whether the authenticated user owns it, collaborates on it, or may view it. The caller's user id is used only to annotate the response, allowing any authenticated user who obtains another collection's id to read the owner's identity, collection name and description, reviews, and complete item list across the tenant boundary. This issue is fixed in version 10.5.6.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-09 22:35 UTC

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7886 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/IgnisDa/ryot/security/advisori…	x_refsource_CONFIRM
https://github.com/IgnisDa/ryot/pull/1870	x_refsource_MISC
https://github.com/IgnisDa/ryot/commit/822cc6701b…	x_refsource_MISC
https://github.com/IgnisDa/ryot/releases/tag/v10.5.6	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
IgnisDa	ryot	Affected: < 10.5.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119800",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T22:35:16.005330Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T22:42:32.872Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ryot",
          "vendor": "IgnisDa",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 10.5.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Ryot is a self-hosted personal tracking application. Prior to 10.5.6, the collectionContents GraphQL query implemented by collection_contents() in crates/services/collection/src/content_operations.rs accepts a caller-controlled CollectionContentsInput.collection_id and returns a collection without checking whether the authenticated user owns it, collaborates on it, or may view it. The caller\u0027s user id is used only to annotate the response, allowing any authenticated user who obtains another collection\u0027s id to read the owner\u0027s identity, collection name and description, reviews, and complete item list across the tenant boundary. This issue is fixed in version 10.5.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T21:29:32.910Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/IgnisDa/ryot/security/advisories/GHSA-pv32-9hxm-ph4v",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/IgnisDa/ryot/security/advisories/GHSA-pv32-9hxm-ph4v"
        },
        {
          "name": "https://github.com/IgnisDa/ryot/pull/1870",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/IgnisDa/ryot/pull/1870"
        },
        {
          "name": "https://github.com/IgnisDa/ryot/commit/822cc6701b46aedbc436abbf02e7efb94afd5f05",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/IgnisDa/ryot/commit/822cc6701b46aedbc436abbf02e7efb94afd5f05"
        },
        {
          "name": "https://github.com/IgnisDa/ryot/releases/tag/v10.5.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/IgnisDa/ryot/releases/tag/v10.5.6"
        }
      ],
      "source": {
        "advisory": "GHSA-pv32-9hxm-ph4v",
        "discovery": "UNKNOWN"
      },
      "title": "Ryot: Cross-tenant collection read via `collectionContents`"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-119800",
    "datePublished": "2026-11-06T21:29:32.910Z",
    "dateReserved": "2026-10-30T16:28:37.900Z",
    "dateUpdated": "2026-11-09T22:42:32.872Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-77442 (GCVE-0-2026-77442)

Vulnerability from cvelistv5 – Published: 2026-11-06 21:26 – Updated: 2026-11-09 13:29

Title

Ryot: `createOrUpdateUserIntegration` trusts a client-supplied `integrationId` with no ownership check, letting any user hijack/overwrite another user's integration (cross-tenant IDOR)

Summary

Ryot is a self-hosted personal tracking application. Prior to 10.4.0, the createOrUpdateUserIntegration GraphQL mutation in crates/services/user/src/integration_operations.rs allows a low-privileged authenticated user to supply another user's integrationId to create_or_update_user_integration() without an ownership check. SeaORM treats the supplied primary key as an update target, and the operation assigns the caller's user_id while replacing the targeted integration's provider_specifics and other configuration, which can transfer ownership, overwrite configuration, or disable the victim's integration. Exploitation requires obtaining the victim's non-brute-forceable integration id, and the vulnerable update does not disclose existing stored credential values. This issue is fixed in version 10.4.0.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-09 13:28 UTC

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key
CWE-862 - Missing Authorization

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7886 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/IgnisDa/ryot/security/advisori…	x_refsource_CONFIRM
https://github.com/IgnisDa/ryot/pull/1797	x_refsource_MISC
https://github.com/IgnisDa/ryot/commit/c4dffc68fc…	x_refsource_MISC
https://github.com/IgnisDa/ryot/releases/tag/v10.4.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
IgnisDa	ryot	Affected: < 10.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77442",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T13:28:42.830777Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T13:29:06.702Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/IgnisDa/ryot/security/advisories/GHSA-cjxv-jj8g-vfvj"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ryot",
          "vendor": "IgnisDa",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 10.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Ryot is a self-hosted personal tracking application. Prior to 10.4.0, the createOrUpdateUserIntegration GraphQL mutation in crates/services/user/src/integration_operations.rs allows a low-privileged authenticated user to supply another user\u0027s integrationId to create_or_update_user_integration() without an ownership check. SeaORM treats the supplied primary key as an update target, and the operation assigns the caller\u0027s user_id while replacing the targeted integration\u0027s provider_specifics and other configuration, which can transfer ownership, overwrite configuration, or disable the victim\u0027s integration. Exploitation requires obtaining the victim\u0027s non-brute-forceable integration id, and the vulnerable update does not disclose existing stored credential values. This issue is fixed in version 10.4.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T21:26:52.401Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/IgnisDa/ryot/security/advisories/GHSA-cjxv-jj8g-vfvj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/IgnisDa/ryot/security/advisories/GHSA-cjxv-jj8g-vfvj"
        },
        {
          "name": "https://github.com/IgnisDa/ryot/pull/1797",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/IgnisDa/ryot/pull/1797"
        },
        {
          "name": "https://github.com/IgnisDa/ryot/commit/c4dffc68fc0aaf65b65c520d1d45d8da52ea8606",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/IgnisDa/ryot/commit/c4dffc68fc0aaf65b65c520d1d45d8da52ea8606"
        },
        {
          "name": "https://github.com/IgnisDa/ryot/releases/tag/v10.4.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/IgnisDa/ryot/releases/tag/v10.4.0"
        }
      ],
      "source": {
        "advisory": "GHSA-cjxv-jj8g-vfvj",
        "discovery": "UNKNOWN"
      },
      "title": "Ryot: `createOrUpdateUserIntegration` trusts a client-supplied `integrationId` with no ownership check, letting any user hijack/overwrite another user\u0027s integration (cross-tenant IDOR)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-77442",
    "datePublished": "2026-11-06T21:26:52.401Z",
    "dateReserved": "2026-08-20T19:59:59.605Z",
    "dateUpdated": "2026-11-09T13:29:06.702Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

10 vulnerabilities by IgnisDa

CVE-2026-127087 (GCVE-0-2026-127087)

CVE-2026-127086 (GCVE-0-2026-127086)

CVE-2026-127085 (GCVE-0-2026-127085)

CVE-2026-77442 (GCVE-0-2026-77442)

CVE-2026-119800 (GCVE-0-2026-119800)

CVE-2026-127085 (GCVE-0-2026-127085)

CVE-2026-127086 (GCVE-0-2026-127086)

CVE-2026-127087 (GCVE-0-2026-127087)

CVE-2026-119800 (GCVE-0-2026-119800)

CVE-2026-77442 (GCVE-0-2026-77442)

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

10 vulnerabilities by IgnisDa

CVE-2026-127087 (GCVE-0-2026-127087)

CVE-2026-127086 (GCVE-0-2026-127086)

CVE-2026-127085 (GCVE-0-2026-127085)

CVE-2026-77442 (GCVE-0-2026-77442)

CVE-2026-119800 (GCVE-0-2026-119800)

CVE-2026-127085 (GCVE-0-2026-127085)

CVE-2026-127086 (GCVE-0-2026-127086)

CVE-2026-127087 (GCVE-0-2026-127087)

CVE-2026-119800 (GCVE-0-2026-119800)

CVE-2026-77442 (GCVE-0-2026-77442)

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.