CVE-2026-127085

MediumCVSS 4.3/10Last modified Nov 13, 2026

Description

Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to remove entries from other users' collections by supplying arbitrary collectionName and creatorUserId values. Attackers can obtain user ids from the usersList query and target fixed collection names like Watchlist to delete collection_to_entity rows belonging to other users.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Nov 13, 2026
Last modified: Nov 13, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1270866.3Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to take over other users' collections by s CVE-2026-1270873.1Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to revoke other users' access links by sup CVE-2026-1270888.12FAuth before 9.0.1 contains a weak password recovery vulnerability that allows unauthenticated attackers to poison reset links by forging t CVE-2026-1270908.8Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contain an authentication b CVE-2026-1270916.8Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contain an improper path eq CVE-2026-1270926.1BuildAdmin 1.0.1 through 2.3.9 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to store javascrip CVE-2026-1270935.5Rustrak before 0.26.0 contains a server-side request forgery vulnerability that allows users with integrations update permission to send req CVE-2026-1270947.6Pagelayer 2.1.7 before 2.2.1 contains a missing authorization vulnerability in Abilities API abilities registered in main/abilitiesregister.CVE-2026-1270995.9A flaw was found in SSSD's conversion of X.509 certificate RSA public keys to SSH keys. Missing size checks before copying RSA components in CVE-2026-12715.3The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versio CVE-2026-127109.3A Missing Authorization vulnerability in the QueryEngineTask of Google Cloud Application Integration (versions from 2025-04-28 to 2026-04-04 CVE-2026-1271005.5A flaw was found in SSSD's PAM responder on builds with the JSON PAM extension enabled. A local attacker can submit a crafted authentication