The Ryot application contains a GraphQL query that returns an entire collection when supplied with a collection ID but does not verify that the authenticated user owns, collaborates on, or is authorized to view the collection. This results in unauthorized disclosure of the collection owner’s identity, collection name, description, reviews, and all items, allowing a user to read data from other tenants. The weakness is a CWE‑639 third‑party access flaw and does not allow code execution or privilege escalation, but it does enable cross‑tenant data leakage.

All versions of the IgnisDa Ryot self‑hosted personal tracking application prior to v10.5.6 are affected. The vulnerability is fixed in release v10.5.6 and any newer versions.

The CVSS score of 4.3 indicates moderate severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower likelihood of widespread exploitation at this time. The attack requires an authenticated user who knows or can guess a valid collection ID; it is therefore exploitable in environments where collection IDs are exposed or enumerated. Even though the risk is moderate, the potential for sensitive data leakage across tenant boundaries warrants timely remediation.