Authorization Bypass in Ryot Allows Collection Deletion

Executive Summary

Ryot before version 10.5.6 has an authorization bypass vulnerability where authenticated users can remove entries from other users' collections by providing arbitrary collectionName and creatorUserId values. Attackers can exploit this by obtaining user IDs from the usersList query and targeting fixed collection names like Watchlist to delete entries belonging to other users.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check Ryot instances running versions before 10.5.6 for unauthorized collection deletions. Review logs for suspicious activity involving the deployRemoveEntitiesFromCollectionJob function or attempts to modify collections like Watchlist. Verify if user IDs are exposed via the usersList endpoint.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to delete items from your collections without your permission. They can empty your curated lists by iterating over known entity IDs if they know your user ID and the collection name. This could lead to data loss and disruption of your curated content.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Ryot to version 10.5.6 or later to patch the authorization bypass. Restrict access to the usersList endpoint to prevent enumeration of user IDs. Review and audit collection modification logs for signs of exploitation.

Useful 0 Not Useful 0