EUVD-2026-125095

Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to revoke other users' access links by supplying an arbitrary accessLinkId. Attackers can obtain access link ids from public share URLs and revoke them without ownership checks, breaking shared acces...

CVE-2026-127087

The Ryot application versions prior to 10.5.6 is vulnerable to an authorization bypass via the revokeAccessLink GraphQL mutation. An authenticated user can revoke access links belonging to other users by providing an arbitrary accessLinkId. Attackers can source these IDs from public share URLs , ...