Description
Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to remove entries from other users' collections by supplying arbitrary collectionName and creatorUserId values. Attackers can obtain user ids from the usersList query and target fixed collection names like Watchlist to delete collection_to_entity rows belonging to other users.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| IgnisDa | ryot | < 10.5.6 | 10.5.6 |
References
- GitHub Security Advisory (GHSA-qwh4-gwr7-95x8) vendor-advisory
- https://github.com/IgnisDa/ryot/commit/822cc6701b46aedbc436abbf02e7efb94afd5f05 patch
- Ryot v10.5.6 Release Notes release-notes
- https://github.com/IgnisDa/ryot/blob/v10.5.5/crates/utils/dependent/collection/src/lib.rs#L232-L251 technical-description
- VulnCheck Advisory: Ryot before 10.5.6 Authorization Bypass via deployRemoveEntitiesFromCollectionJob third-party-advisory