CVE-2026-127086

The Ryot application (versions before 10.5.6 ) is vulnerable to an authorization bypass via the createOrUpdateCollection GraphQL mutation. An authenticated attacker who knows a target collection id can provide an updateId to trigger an unauthorized ownership reassignment. This allows the attacker...