CVE-2026-77442

Name of the Vulnerable Software and Affected Versions Ryot versions prior to 10.4.0

Description A low-privileged authenticated user can exploit the createOrUpdateUserIntegration GraphQL mutation in crates/services/user/src/integration operations.rs by providing another user's integrationId to the create or update user integration() function. Due to a missing ownership check, SeaORM uses the provided primary key as an update target, assigning the caller's user id and replacing the provider specifics and other configurations of the targeted integration. This allows an attacker to transfer ownership, overwrite configurations, or disable a victim's integration, provided they have obtained the victim's non-brute-forceable integration ID. The operation does not disclose existing stored credential values.

Recommendations Update to version 10.4.0.