{"affected":[{"defaultStatus":"unaffected","ecosystem":"github","packageName":"IgnisDa/ryot","product":"ryot","source":"CNA: VulnCheck","vendor":"IgnisDa","versions":[{"lessThan":"10.5.6","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-127085","cwes":["CWE-639"],"description":"Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to remove entries from other users' collections by supplying arbitrary collectionName and creatorUserId values. Attackers can obtain user ids from the usersList query and target fixed collection names like Watchlist to delete collection_to_entity rows belonging to other users.","epss":{"date":"2026-11-13","percentile":0.30863,"score":0.00366},"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://github.com/IgnisDa/ryot/security/advisories/GHSA-qwh4-gwr7-95x8"}],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0"},{"score":4.3,"severity":"medium","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},{"score":5.3,"severity":"medium","source":"NVD: disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0"},{"score":4.3,"severity":"medium","source":"NVD: disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"}],"modifiedAt":1794593922440,"publishedAt":1794562458133,"references":[{"source":"CNA: VulnCheck","tags":["vendor-advisory"],"url":"https://github.com/IgnisDa/ryot/security/advisories/GHSA-qwh4-gwr7-95x8"},{"source":"CNA: VulnCheck","tags":["patch"],"url":"https://github.com/IgnisDa/ryot/commit/822cc6701b46aedbc436abbf02e7efb94afd5f05"},{"source":"CNA: VulnCheck","tags":["release-notes"],"url":"https://github.com/IgnisDa/ryot/releases/tag/v10.5.6"},{"source":"CNA: VulnCheck","tags":["technical-description"],"url":"https://github.com/IgnisDa/ryot/blob/v10.5.5/crates/utils/dependent/collection/src/lib.rs#L232-L251"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/ryot-before-10.5.6-authorization-bypass-via-deployremoveentitiesfromcollectionjob"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://github.com/IgnisDa/ryot/security/advisories/GHSA-qwh4-gwr7-95x8"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://github.com/IgnisDa/ryot/blob/v10.5.5/crates/utils/dependent/collection/src/lib.rs#L232-L251"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://github.com/IgnisDa/ryot/commit/822cc6701b46aedbc436abbf02e7efb94afd5f05"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://github.com/IgnisDa/ryot/releases/tag/v10.5.6"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://github.com/IgnisDa/ryot/security/advisories/GHSA-qwh4-gwr7-95x8"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://www.vulncheck.com/advisories/ryot-before-10.5.6-authorization-bypass-via-deployremoveentitiesfromcollectionjob"}],"remediation":[{"kind":"fix","source":"CNA: VulnCheck","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/IgnisDa/ryot/commit/822cc6701b46aedbc436abbf02e7efb94afd5f05"}],"revision":"a902a582069eb25f9089da6dbc6c691d8ccbf36a5280bcf1a70ee8390e427382","sources":[{"modifiedAt":1794593922440,"name":"CNA: VulnCheck","retrievedAt":1794597901892,"url":"https://www.cve.org/CVERecord?id=CVE-2026-127085"},{"modifiedAt":1794585219657,"name":"NVD","retrievedAt":1794593946910,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127085"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794597921361,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-127085"}],"ssvc":{"assessedAt":1794593864374,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Ryot before 10.5.6 Authorization Bypass via deployRemoveEntitiesFromCollectionJob","updatedAt":1794597921361}