{"id":"CVE-2026-77442","kind":"vulnerability","aliases":["CVE-2026-77442"],"related":[],"title":"Ryot: authenticated users can overwrite other users' integrations via GraphQL","description":"Ryot is a self-hosted personal tracking application. Prior to 10.4.0, the createOrUpdateUserIntegration GraphQL mutation in crates/services/user/src/integration_operations.rs allows a low-privileged authenticated user to supply another user's integrationId to create_or_update_user_integration() without an ownership check. SeaORM treats the supplied primary key as an update target, and the operation assigns the caller's user_id while replacing the targeted integration's provider_specifics and other configuration, which can transfer ownership, overwrite configuration, or disable the victim's integration. Exploitation requires obtaining the victim's non-brute-forceable integration id, and the vulnerable update does not disclose existing stored credential values. This issue is fixed in version 10.4.0.","summary":"Ryot is a self-hosted personal tracking app. A logged-in low-privileged user can supply another user's integration ID to a GraphQL mutation that lacks an ownership check, letting them take over, reconfigure, or disable the victim's integration.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["graphql","package","ryot","self-hosted"],"not_affected_if":["single-user-instance","version-10.4.0-or-later"],"how_to_check":"- Check the Ryot version in use; affected versions are those before `10.4.0`.\n- Confirm whether the instance is reachable by users who hold accounts on it.","fix":"- Ryot: upgrade to `10.4.0` or later.","status":"open","published_at":"2026-11-06T22:17:59+00:00","first_seen_at":"2026-11-06T22:44:33+00:00","triaged_at":"2026-11-06T22:44:47+00:00","updated_at":"2026-11-06T22:44:47+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-06T22:44:47Z","model":"claude-haiku-5-5","output":{"fix":"- Ryot: upgrade to `10.4.0` or later.","reach":"network","title":"Ryot: authenticated users can overwrite other users' integrations via GraphQL","impact":"medium","summary":"Ryot is a self-hosted personal tracking app. A logged-in low-privileged user can supply another user's integration ID to a GraphQL mutation that lacks an ownership check, letting them take over, reconfigure, or disable the victim's integration.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ryot","self-hosted","graphql"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"another user's integration is taken over, reconfigured, or disabled","analyst_note":"","how_to_check":"- Check the Ryot version in use; affected versions are those before `10.4.0`.\n- Confirm whether the instance is reachable by users who hold accounts on it.","plain_action":"","needs_analyst":false,"not_affected_if":["single-user-instance","version-10.4.0-or-later"],"who_is_affected":"Exposed when a Ryot instance has multiple user accounts and integrations are in use, since an attacker must be a logged-in user and must know the victim's integration ID. Single-user self-hosted instances with no other accounts are unlikely to be affected. The sources do not say whether default configurations enable integrations.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000698,"input_tokens":4405,"output_tokens":515,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-77442':13A,16A '10.4.0':78C,179C 'allow':85C 'anoth':42B,94C 'app':31B 'applic':75C 'assign':121C 'authent':2A,90C 'brute':158C 'caller':123C 'check':55B,107C 'configur':137C,143C 'crates/services/user/src/integration_operations.rs':84C 'creat':99C 'createorupdateuserintegr':80C 'credenti':171C 'cve':11A,14A 'disabl':62B,145C 'disclos':168C 'exist':169C 'exploit':150C 'fix':176C 'forceabl':159C 'graphql':10A,17B,49B,81C 'host':22B,28B,72C 'id':46B,126C,161C 'integr':8A,45B,66B,103C,131C,149C,160C 'integrationid':97C 'issu':174C 'key':113C 'lack':52B 'let':56B 'log':34B 'logged-in':33B 'low':37B,88C 'low-privileg':36B,87C 'mutat':50B,82C 'non':157C 'non-brute-forc':156C 'obtain':152C 'oper':120C 'overwrit':5A,142C 'ownership':54B,106C,141C 'packag':18B 'person':29B,73C 'primari':112C 'prior':76C 'privileg':38B,89C 'provid':133C 'reconfigur':60B 'replac':128C 'requir':151C 'ryot':1A,19B,23B,67C 'seaorm':108C 'self':21B,27B,71C 'self-host':20B,26B,70C 'specif':134C 'store':170C 'suppli':41B,93C,111C 'take':58B 'target':117C,130C 'track':30B,74C 'transfer':140C 'treat':109C 'updat':101C,116C,165C 'user':3A,7A,39B,43B,91C,95C,102C,125C 'valu':172C 'version':178C 'via':9A 'victim':64B,147C,154C 'vulner':164C 'without':104C","nicknames":[],"mitigations":[],"who_affected":"Exposed when a Ryot instance has multiple user accounts and integrations are in use, since an attacker must be a logged-in user and must know the victim's integration ID. Single-user self-hosted instances with no other accounts are unlikely to be affected. The sources do not say whether default configurations enable integrations.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["graphql","medium","package","ryot","selfhosted"],"campaign_type":null,"search_a":"'-2026':12A,15A '-77442':13A,16A 'authent':2A 'cve':11A,14A 'graphql':10A 'integr':8A 'overwrit':5A 'ryot':1A 'user':3A,7A 'via':9A","search_b":"'anoth':42B 'app':31B 'check':55B 'disabl':62B 'graphql':17B,49B 'host':22B,28B 'id':46B 'integr':45B,66B 'lack':52B 'let':56B 'log':34B 'logged-in':33B 'low':37B 'low-privileg':36B 'mutat':50B 'ownership':54B 'packag':18B 'person':29B 'privileg':38B 'reconfigur':60B 'ryot':19B,23B 'self':21B,27B 'self-host':20B,26B 'suppli':41B 'take':58B 'track':30B 'user':39B,43B 'victim':64B","search_c":"'10.4.0':78C,179C 'allow':85C 'anoth':94C 'applic':75C 'assign':121C 'authent':90C 'brute':158C 'caller':123C 'check':107C 'configur':137C,143C 'crates/services/user/src/integration_operations.rs':84C 'creat':99C 'createorupdateuserintegr':80C 'credenti':171C 'disabl':145C 'disclos':168C 'exist':169C 'exploit':150C 'fix':176C 'forceabl':159C 'graphql':81C 'host':72C 'id':126C,161C 'integr':103C,131C,149C,160C 'integrationid':97C 'issu':174C 'key':113C 'low':88C 'low-privileg':87C 'mutat':82C 'non':157C 'non-brute-forc':156C 'obtain':152C 'oper':120C 'overwrit':142C 'ownership':106C,141C 'person':73C 'primari':112C 'prior':76C 'privileg':89C 'provid':133C 'replac':128C 'requir':151C 'ryot':67C 'seaorm':108C 'self':71C 'self-host':70C 'specif':134C 'store':170C 'suppli':93C,111C 'target':117C,130C 'track':74C 'transfer':140C 'treat':109C 'updat':101C,116C,165C 'user':91C,95C,102C,125C 'valu':172C 'version':178C 'victim':147C,154C 'vulner':164C 'without':104C","first_public_at":"2026-07-13T17:35:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-77442","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77442","severity":null,"published_at":"2026-11-06T22:17:59+00:00","modified_at":"2026-11-06T22:17:59+00:00","first_seen_at":"2026-11-06T22:44:33+00:00","fetched_at":"2026-11-06T22:44:33+00:00","note":null}],"documents":[{"id":90792,"url":"https://github.com/IgnisDa/ryot/commit/c4dffc68fc0aaf65b65c520d1d45d8da52ea8606","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":90793,"url":"https://github.com/IgnisDa/ryot/releases/tag/v10.4.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":90794,"url":"https://github.com/IgnisDa/ryot/security/advisories/GHSA-cjxv-jj8g-vfvj","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-13T17:35:28+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}