CVE-2026-127085

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-127085", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-12T14:14:20.971Z", "datePublished": "2026-11-13T09:34:18.133Z", "dateUpdated": "2026-11-13T18:18:42.440Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-13T09:34:18.133Z"}, "datePublic": "2026-11-01T05:26:17.000Z", "title": "Ryot before 10.5.6 Authorization Bypass via deployRemoveEntitiesFromCollectionJob", "descriptions": [{"lang": "en", "value": "Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to remove entries from other users' collections by supplying arbitrary collectionName and creatorUserId values. Attackers can obtain user ids from the usersList query and target fixed collection names like Watchlist to delete collection_to_entity rows belonging to other users."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Authorization Bypass Through User-Controlled Key", "cweId": "CWE-639", "type": "CWE"}]}], "affected": [{"vendor": "IgnisDa", "product": "ryot", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "10.5.6", "status": "affected", "versionType": "semver"}], "packageURL": "pkg:github/IgnisDa/ryot", "repo": "https://github.com/IgnisDa/ryot"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/IgnisDa/ryot/security/advisories/GHSA-qwh4-gwr7-95x8", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-qwh4-gwr7-95x8)"}, {"url": "https://github.com/IgnisDa/ryot/commit/822cc6701b46aedbc436abbf02e7efb94afd5f05", "tags": ["patch"]}, {"url": "https://github.com/IgnisDa/ryot/releases/tag/v10.5.6", "tags": ["release-notes"], "name": "Ryot v10.5.6 Release Notes"}, {"url": "https://github.com/IgnisDa/ryot/blob/v10.5.5/crates/utils/dependent/collection/src/lib.rs#L232-L251", "tags": ["technical-description"]}, {"name": "VulnCheck Advisory: Ryot before 10.5.6 Authorization Bypass via deployRemoveEntitiesFromCollectionJob", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/ryot-before-10.5.6-authorization-bypass-via-deployremoveentitiesfromcollectionjob"}], "credits": [{"lang": "en", "value": "Sandipkumar sah", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"references": [{"url": "https://github.com/IgnisDa/ryot/security/advisories/GHSA-qwh4-gwr7-95x8", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-13T18:17:44.374719Z", "id": "CVE-2026-127085", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-13T18:18:42.440Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/IgnisDa/ryot", "product": "ryot", "repo": "https://github.com/IgnisDa/ryot", "vendor": "IgnisDa", "versions": [{"lessThan": "10.5.6", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to remove entries from other users' collections by supplying arbitrary collectionName and creatorUserId values. Attackers can obtain user ids from the usersList query and target fixed collection names like Watchlist to delete collection_to_entity rows belonging to other users."}], "id": "CVE-2026-127085", "lastModified": "2026-11-13T15:53:39.657", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "disclosure@vulncheck.com", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}]}, "published": "2026-11-13T10:18:05.010", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/IgnisDa/ryot/blob/v10.5.5/crates/utils/dependent/collection/src/lib.rs#L232-L251"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/IgnisDa/ryot/commit/822cc6701b46aedbc436abbf02e7efb94afd5f05"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/IgnisDa/ryot/releases/tag/v10.5.6"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/IgnisDa/ryot/security/advisories/GHSA-qwh4-gwr7-95x8"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/ryot-before-10.5.6-authorization-bypass-via-deployremoveentitiesfromcollectionjob"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "disclosure@vulncheck.com", "type": "Primary"}]}

{}

{}