Threats tagged 'ghsa-3g3g-3r3m-hvpw'

Ryot versions prior to 10.5.6 have an authorization bypass vulnerability that allows authenticated users to delete entries from other users' collections by manipulating collectionName and creatorUserId parameters. User IDs can be enumerated via the usersList query, enabling targeted deletion of collection entries such as those in the Watchlist collection.