CVE-2026-119800

Name of the Vulnerable Software and Affected Versions Ryot versions prior to 10.5.6

Description The collectionContents GraphQL query, implemented by the collection contents() function, fails to verify if the authenticated user has the necessary permissions to access a collection. By manipulating the collection id variable within the CollectionContentsInput, an authenticated user can access collections they do not own or collaborate on. This allows the unauthorized retrieval of the owner's identity, collection name, description, reviews, and the full item list across tenant boundaries.

Recommendations Update to version 10.5.6.