Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to remove entries from other users' collections by supplying arbitrary collectionName and creatorUserId values. Attackers can obtain user ids from the usersList query and target fixed collection names like Watchlist to delete collectiontoentity rows belonging to other users.
Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to take over other users' collections by supplying an updateId to the createOrUpdateCollection GraphQL mutation. Attackers who know a collection id can trigger ownership reassignment without checks, read its items, rewrite metadata, and evict the original owner and collaborators.
Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to revoke other users' access links by supplying an arbitrary accessLinkId. Attackers can obtain access link ids from public share URLs and revoke them without ownership checks, breaking shared access for all link users.
Ryot is a self-hosted personal tracking application. Prior to 10.5.6, the collectionContents GraphQL query implemented by collectioncontents() in crates/services/collection/src/contentoperations.rs accepts a caller-controlled CollectionContentsInput.collectionid and returns a collection without checking whether the authenticated user owns it, collaborates on it, or may view it. The caller's user id is used only to annotate the response, allowing any authenticated user who obtains another collection's id to read the owner's identity, collection name and description, reviews, and complete item list across the tenant boundary. This issue is fixed in version 10.5.6.
Ryot is a self-hosted personal tracking application. Prior to 10.5.6, the collectionContents GraphQL query implemented by collectioncontents() in crates/services/collection/src/contentoperations.rs accepts a caller-controlled CollectionContentsInput.collectionid and returns a collection without checking whether the authenticated user owns it, collaborates on it, or may view it. The caller's user id is used only to annotate the response, allowing any authenticated user who obtains another collection's id to read the owner's identity, collection name and description, reviews, and complete item list across the tenant boundary. This issue is fixed in version 10.5.6.
Ryot is a self-hosted personal tracking application. Prior to 10.4.0, the createOrUpdateUserIntegration GraphQL mutation in crates/services/user/src/integrationoperations.rs allows a low-privileged authenticated user to supply another user's integrationId to createorupdateuserintegration() without an ownership check. SeaORM treats the supplied primary key as an update target, and the operation assigns the caller's userid while replacing the targeted integration's providerspecifics and other configuration, which can transfer ownership, overwrite configuration, or disable the victim's integration. Exploitation requires obtaining the victim's non-brute-forceable integration id, and the vulnerable update does not disclose existing stored credential values. This issue is fixed in version 10.4.0.
Ryot is a self-hosted personal tracking application. Prior to 10.4.0, the createOrUpdateUserIntegration GraphQL mutation in crates/services/user/src/integrationoperations.rs allows a low-privileged authenticated user to supply another user's integrationId to createorupdateuserintegration() without an ownership check. SeaORM treats the supplied primary key as an update target, and the operation assigns the caller's userid while replacing the targeted integration's providerspecifics and other configuration, which can transfer ownership, overwrite configuration, or disable the victim's integration. Exploitation requires obtaining the victim's non-brute-forceable integration id, and the vulnerable update does not disclose existing stored credential values. This issue is fixed in version 10.4.0.