Read the docs
TI-2026-86149 Aliases CVE-2026-119800

Cross-tenant collection read via collectionContents in Ryot

Priority LOW 19CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

Ryot, a self-hosted personal tracking application by IgnisDa, is affected before 10.5.6. The collectionContents GraphQL query does not check whether the authenticated user owns, collaborates on, or may view the collection whose id the caller supplies, an authorization bypass through a user-controlled key (CWE-639). Any authenticated user who obtains another collection's id can read the owner's identity, collection name and description, reviews, and full item list across the tenant boundary. The attack requires low privileges and no user interaction.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Ryot is a self-hosted personal tracking application. Prior to 10.5.6, the collectionContents GraphQL query implemented by collection_contents() in crates/services/collection/src/content_operations.rs accepts a caller-controlled CollectionContentsInput.collection_id and returns a collection without checking whether the authenticated user owns it, collaborates on it, or may view it. The caller's user id is used only to annotate the response, allowing any authenticated user who obtains another collection's id to read the owner's identity, collection name and description, reviews, and complete item list across the tenant boundary. This issue is fixed in version 10.5.6.

Why it matters now

EPSS 0.00199 9th percentileScored 2026-11-07
Fix Fixed ryot (IgnisDa): 10.5.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
IgnisDaryotbefore 10.5.610.5.6Patch availableCNA
  • ryot VendorIgnisDa Affected before 10.5.6 Fixed in 10.5.6 Patch available CNA

Remediation

The fixed version is Ryot 10.5.6 for IgnisDa ryot. The sources list no advisory identifier for this fix.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA ryot (IgnisDa) Fixed in 10.5.6

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-119800

References

Other 4

  • TI-2026-86144 Missing ownership check lets Ryot users overwrite others' integrations CVSS 3.1MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences