MEDIUMCVSS v3.1 6.3Vulnerability
CVE-2026-127086
Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to take over other users' collections by supplying an updateId to the createOrUpdateCollection GraphQL mutation. Attackers who know a collection id can trigger ownership reassignment without checks, read its items, rewrite metadata, and evict the original owner and collaborators.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-11-14T00:40:25.638091+00:00
- Epss score
- 0.00361
- Cvss score
- 6.3
- Cvss severity
- MEDIUM
- Retrieved at
- 2026-11-14T00:51:03+00:00
- Score
- 6.3
- Last source
- FIRST EPSS
- Cvss version
- 3.1
- Cve id
- CVE-2026-127086
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- First seen by Signal
- 2026-11-13T17:31:47+00:00
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- Published at
- 2026-11-13T10:18:05.163
- Last modified
- 2026-11-13T15:53:39.657
- Epss percentile
- 0.30311
Related Entities (1)
HAS_WEAKNESS (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph