Skip to content
OpenAdvisories

Vendor

IgnisDa

2 known vulnerabilities.

Products

ryot 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 4.3
    CVE-2026-119800

    Ryot: Cross-tenant collection read via `collectionContents`

    Ryot is a self-hosted personal tracking application. Prior to 10.5.6, the collectionContents GraphQL query implemented by collection_contents() in crates/services/collection/src/content_operations.rs accepts a caller-controlled CollectionContentsInput.collect…

    IgnisDa ryot
  • Medium 5.9
    CVE-2026-77442

    Ryot: `createOrUpdateUserIntegration` trusts a client-supplied `integrationId` with no ownership check, letting any user hijack/overwrite another user's integration (cross-tenant IDOR)

    Ryot is a self-hosted personal tracking application. Prior to 10.4.0, the createOrUpdateUserIntegration GraphQL mutation in crates/services/user/src/integration_operations.rs allows a low-privileged authenticated user to supply another user's integrationId to…

    IgnisDa ryot