CVE-2026-119800 Ryot: Cross-tenant collection read via `collectionContents`

Ryot is a self-hosted personal tracking application. Prior to 10.5.6, the collectionContents GraphQL query implemented by collectioncontents in crates/services/collection/src/contentoperations.rs accepts a caller-controlled CollectionContentsInput.collectionid and returns a collection without...

CVE-2026-119800 Ryot: Cross-tenant collection read via `collectionContents`

Ryot is a self-hosted personal tracking application. Prior to 10.5.6, the collectionContents GraphQL query implemented by collectioncontents in crates/services/collection/src/contentoperations.rs accepts a caller-controlled CollectionContentsInput.collectionid and returns a collection without...