CVE-2026-119800

Ryot is a self-hosted personal tracking application. Prior to 10.5.6, the collectionContents GraphQL query implemented by collection_contents() in crates/services/collection/src/content_operations.rs accepts a caller-controlled CollectionContentsInput.collection_id and returns a collection without checking whether the authenticated user owns it, collaborates on it, or may view it. The caller's user id is used only to annotate the response, allowing any authenticated user who obtains another collection's id to read the owner's identity, collection name and description, reviews, and complete item list across the tenant boundary. This issue is fixed in version 10.5.6.

• CWE-639

• https://github.com/IgnisDa/ryot/commit/822cc6701b46aedbc436abbf02e7efb94afd5f05
• https://github.com/IgnisDa/ryot/pull/1870
• https://github.com/IgnisDa/ryot/releases/tag/v10.5.6
• https://github.com/IgnisDa/ryot/security/advisories/GHSA-pv32-9hxm-ph4v

Published

Nov 6, 2026

Last Modified

Nov 6, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11977The WP Post Author – Author Box, Multiple Authors, Guest Aut…6.5
• CVE-2026-119776In all prior released versions of FRRouting, the OSPFv3 (for…6.1
• CVE-2026-119777A flaw was found in GStreamer's gst-plugins-bad H.266/VVC pa…8.8
• CVE-2026-11979libxml2 is vulnerable to multiple stack-based buffer overflo…7.8
• CVE-2026-1198SIMPLE.ERP is vulnerable to the SQL Injection in search func…8.6
• CVE-2026-11980IBM Aspera Desktop App 1.0.5 through 1.0.19 can allow arbitr…7.3
• CVE-2026-11981The GiveWP plugin for WordPress is vulnerable to Cross-Site …4.3
• CVE-2026-11982Grav 2.0.0-rc.9 with Admin2 2.0.0-rc.14 contains a stored cr…5.1
• CVE-2026-11983The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPr…5.3
• CVE-2026-11984The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPr…5.3
• CVE-2026-119842A flaw was found in GStreamer's gst-plugins-base MicroDVD su…6.5
• CVE-2026-119843A flaw was found in GStreamer's gst-plugins-good package. Th…6.5