CVE-2026-127087: Ryot before 10.5.6 Authorization Bypass via revokeAccessLink GraphQL Mutation
Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to revoke other users' access links by supplying an arbitrary accessLinkId. Attackers can obtain access link ids from public share URLs and revoke them without ownership checks, breaking shared access for all link users.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Ryot versions before 10.5.6 are affected. The issue applies where access links are shared publicly, because their identifiers can be obtained from public share URLs.
What does an attacker need to exploit this issue?
An attacker needs an authenticated Ryot account and an accessLinkId for a target link. They do not need to own the link; they can submit the identifier through the revokeAccessLink GraphQL mutation.
What is the impact of successful exploitation?
An attacker can revoke another user's access link, causing shared access through that link to stop working for all users of the link. The provided information indicates an availability impact rather than confidentiality or integrity impact.
How can administrators determine whether they may be affected?
Check whether the Ryot deployment runs a version earlier than 10.5.6 and uses publicly shared access links. Review whether access links have been unexpectedly revoked, particularly links whose IDs may have been exposed in public share URLs.