CVE-2026-127085

Description

Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to remove entries from other users' collections by supplying arbitrary collectionName and creatorUserId values. Attackers can obtain user ids from the usersList query and target fixed collection names like Watchlist to delete collection_to_entity rows belonging to other users.

References

• https://github.com/IgnisDa/ryot/blob/v10.5.5/crates/utils/dependent/collection/src/lib.rs#L232-L251
• https://github.com/IgnisDa/ryot/commit/822cc6701b46aedbc436abbf02e7efb94afd5f05
• https://github.com/IgnisDa/ryot/releases/tag/v10.5.6
• https://github.com/IgnisDa/ryot/security/advisories/GHSA-qwh4-gwr7-95x8
• https://www.vulncheck.com/advisories/ryot-before-10.5.6-authorization-bypass-via-deployremoveentitiesfromcollectionjob