Unauthorized Data Access in Ryot Personal Tracking Application

CVE-2026-119800

What is CVE-2026-119800?

The Ryot personal tracking application has a flaw in its collectionContents GraphQL query that allows any authenticated user to access data belonging to other users. Specifically, prior to version 10.5.6, the system does not verify whether the authenticated user owns or has permissions for the requested collection. Instead, it uses the caller's user ID solely for annotations in the response. This oversight enables users to retrieve sensitive information such as collection names, identities of collection owners, descriptions, reviews, and complete item lists without appropriate authorization. This vulnerability has been addressed in version 10.5.6.

References