IgnisDa ryot vulnerabilities

Latest IgnisDa ryot CVEs

Newest publication first

1. CVE-2026-127085 Ryot before 10.5.6 Authorization Bypass via deployRemoveEntitiesFromCollectionJob

   Published 2026-11-13

   Medium·CVSS 5.3 EPSS 0.37%

   Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to remove entries from other users' collections by supplying arbitrary collectionName and creatorUserId values. Attackers can obtain user ids from the usersList query and target fixe...

2. CVE-2026-127086 Ryot before 10.5.6 Authorization Bypass via createOrUpdateCollection updateId

   Published 2026-11-13

   Medium·CVSS 5.3 EPSS 0.32%

   Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to take over other users' collections by supplying an updateId to the createOrUpdateCollection GraphQL mutation. Attackers who know a collection id can trigger ownership reassignment...

3. CVE-2026-127087 Ryot before 10.5.6 Authorization Bypass via revokeAccessLink GraphQL Mutation

   Published 2026-11-13

   Low·CVSS 2.3 EPSS 0.30%

   Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to revoke other users' access links by supplying an arbitrary accessLinkId. Attackers can obtain access link ids from public share URLs and revoke them without ownership checks, brea...

4. CVE-2026-119800 Ryot: Cross-tenant collection read via `collectionContents`

   Published 2026-11-06

   Medium·CVSS 4.3 EPSS 0.20%

   Ryot is a self-hosted personal tracking application. Prior to 10.5.6, the collectionContents GraphQL query implemented by collection_contents() in crates/services/collection/src/content_operations.rs accepts a caller-controlled CollectionContentsInput.collection_id and returns a...

5. CVE-2026-77442 Ryot: `createOrUpdateUserIntegration` trusts a client-supplied `integrationId` with no ownership check, letting any user hijack/overwrite another user's integration (cross-tenant IDOR)

   Published 2026-11-06

   Medium·CVSS 5.9 EPSS 0.22%

   Ryot is a self-hosted personal tracking application. Prior to 10.4.0, the createOrUpdateUserIntegration GraphQL mutation in crates/services/user/src/integration_operations.rs allows a low-privileged authenticated user to supply another user's integrationId to create_or_update_use...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.