CVE-2026-127085: Ryot before 10.5.6 Authorization Bypass via deployRemoveEntitiesFromCollectionJob
Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to remove entries from other users' collections by supplying arbitrary collectionName and creatorUserId values. Attackers can obtain user ids from the usersList query and target fixed collection names like Watchlist to delete collectiontoentity rows belonging to other users.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ryotto a version that resolves this vulnerability.Fixed in 10.5.6
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Ryot user can exploit it. The attacker needs a target user's ID, which can be obtained through the usersList query, and a target collection name such as Watchlist.
What data can an attacker alter?
An attacker can remove entries from collections owned by other users by supplying arbitrary collectionName and creatorUserId values. The described impact is deletion of collection_to_entity rows; no confidentiality or availability impact is stated.
Which versions need remediation?
Ryot versions before 10.5.6 are affected. Upgrade to version 10.5.6 or later.