CVE-2026-77442: Ryot: `createOrUpdateUserIntegration` trusts a client-supplied `integrationId` with no ownership check, letting any user hijack/overwrite another user's integration (cross-tenant IDOR)
Ryot is a self-hosted personal tracking application. Prior to 10.4.0, the createOrUpdateUserIntegration GraphQL mutation in crates/services/user/src/integrationoperations.rs allows a low-privileged authenticated user to supply another user's integrationId to createorupdateuserintegration() without an ownership check. SeaORM treats the supplied primary key as an update target, and the operation assigns the caller's userid while replacing the targeted integration's providerspecifics and other configuration, which can transfer ownership, overwrite configuration, or disable the victim's integration. Exploitation requires obtaining the victim's non-brute-forceable integration id, and the vulnerable update does not disclose existing stored credential values. This issue is fixed in version 10.4.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ryotto a version that resolves this vulnerability.Fixed in 10.4.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Any low-privileged authenticated Ryot user can exploit it if they obtain another user's integration ID. The ID is described as non-brute-forceable, so an attacker needs a way to learn a valid victim integration ID rather than simply guessing one.
What can an attacker do with a victim's integration ID?
The attacker can cause the targeted integration to be updated under their own user ID, overwrite its provider-specific and other configuration, or disable it. The vulnerable operation does not reveal the victim's existing stored credential values.
Which deployments are affected and what is the fix?
Ryot versions prior to 10.4.0 are affected. Upgrade to version 10.4.0, which includes the ownership-check fix.