User Integration Vulnerability in Ryot Personal Tracking Application

CVE-2026-77442

What is CVE-2026-77442?

The Ryot personal tracking application has a serious vulnerability where a low-privileged authenticated user can misuse the createOrUpdateUserIntegration GraphQL mutation. This allows them to provide another user’s integration ID, enabling unauthorized updates to ownership and configurations of integrations. With exploitation requiring only the victim's non-brute-forceable integration ID, attackers can overwrite important settings or even disable the victim's integration without disclosing existing credential values. This vulnerability has been addressed in version 10.4.0, ensuring stronger access control measures.

References