Ryot: Cross-tenant collection read via `collectionContents`

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

Ryot is a self-hosted personal tracking application. Prior to 10.5.6, the collectionContents GraphQL query implemented by collection_contents() in crates/services/collection/src/content_operations.rs accepts a caller-controlled CollectionContentsInput.collection_id and returns a collection without checking whether the authenticated user owns it, collaborates on it, or may view it. The caller's user id is used only to annotate the response, allowing any authenticated user who obtains another collection's id to read the owner's identity, collection name and description, reviews, and complete item list across the tenant boundary. This issue is fixed in version 10.5.6.

Etkilenen sürümler1 yazılım

Kaynaklar6 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…a/ryot/security/advisories/GHSA-pv32-9hxm-ph4v Diğer
• github.com/IgnisDa/ryot/pull/1870 Diğer
• github.com/…ommit/822cc6701b46aedbc436abbf02e7efb94afd5f05 Diğer
• github.com/IgnisDa/ryot/releases/tag/v10.5.6 Diğer

Kayıt geçmişi

1. 7 Kas 2026 00:29Yayımlandı

İlgili açıklar

• 5,9 CVE-2026-77442Ryot: `createOrUpdateUserIntegration` trusts a client-supplied `integrationId` with no ownership check, letting any u…
• 8,8 CVE-2026-85712Chartbrew: Cross-tenant project takeover via body.team_id in /project routes
• 6,5 CVE-2026-634372FAuth: Missing Authorization on Share Recipients Endpoint Allows Cross-User Account Enumeration
• 4,3 CVE-2026-124025Faveo Helpdesk through 2.0.3 Cross-Department Ticket Disclosure via /ticket/print
• 7,5 CVE-2026-62344Wanderer: Unauthenticated Access to Private Trails and Comments via ActivityPub Endpoints
• 6,5 CVE-2026-62852FreeScout: Missing Authorization and Exposure of Sensitive Information to an Unauthorized Actor and Authorization Bypass Through User-Controlled Key