---
id: "CVE-2026-77442"
page: "https://infrastack.ai/live/CVE-2026-77442"
kind: "vulnerability"
aliases: ["CVE-2026-77442"]
title: "Ryot: authenticated users can overwrite other users' integrations via GraphQL"
severity: "medium"
cvss: 5.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["graphql", "package", "ryot", "self-hosted"]
not_affected_if: ["single-user-instance", "version-10.4.0-or-later"]
published_at: "2026-11-06T22:17:59+00:00"
first_seen_at: "2026-11-06T22:44:33+00:00"
updated_at: "2026-11-06T22:44:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77442", "first_seen_at": "2026-11-06T22:44:33+00:00"}]
exploit_sources: []
---

# Ryot: authenticated users can overwrite other users' integrations via GraphQL

Link for people: https://infrastack.ai/live/CVE-2026-77442 (this .md is for agents)

Ryot is a self-hosted personal tracking app. A logged-in low-privileged user can supply another user's integration ID to a GraphQL mutation that lacks an ownership check, letting them take over, reconfigure, or disable the victim's integration.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Ryot version in use; affected versions are those before `10.4.0`.
- Confirm whether the instance is reachable by users who hold accounts on it.

## Fix

- Ryot: upgrade to `10.4.0` or later.

## Timeline

- 2026-11-06T22:44:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-77442

## Documents

- [advisory] Vendor advisory: github.com https://github.com/IgnisDa/ryot/security/advisories/GHSA-cjxv-jj8g-vfvj
- [fix] Patch: github.com https://github.com/IgnisDa/ryot/commit/c4dffc68fc0aaf65b65c520d1d45d8da52ea8606
- [fix] Release notes: github.com https://github.com/IgnisDa/ryot/releases/tag/v10.4.0

## From the sources

Ryot is a self-hosted personal tracking application. Prior to 10.4.0, the createOrUpdateUserIntegration GraphQL mutation in crates/services/user/src/integration_operations.rs allows a low-privileged authenticated user to supply another user's integrationId to create_or_update_user_integration() without an ownership check. SeaORM treats the supplied primary key as an update target, and the operation assigns the caller's user_id while replacing the targeted integration's provider_specifics and other configuration, which can transfer ownership, overwrite configuration, or disable the victim's integration. Exploitation requires obtaining the victim's non-brute-forceable integration id, and the vulnerable update does not disclose existing stored credential values. This issue is fixed in version 10.4.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_