EUVD-2026-118518

Ryot is a self-hosted personal tracking application. Prior to 10.5.6, the collectionContents GraphQL query implemented by collectioncontents in crates/services/collection/src/contentoperations.rs accepts a caller-controlled CollectionContentsInput.collectionid and returns a collection without...

CVE-2026-119800

The self-hosted personal tracking application Ryot is vulnerable to a cross-tenant collection read issue in versions prior to 10.5.6 . The collectionContents GraphQL query, implemented by collection_contents() in crates/services/collection/src/content_operations.rs, fails to verify if an authenti...