Ryot: `createOrUpdateUserIntegration` trusts a client-supplied `integrationId` with no ownership check, letting any u…

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

Ryot is a self-hosted personal tracking application. Prior to 10.4.0, the createOrUpdateUserIntegration GraphQL mutation in crates/services/user/src/integration_operations.rs allows a low-privileged authenticated user to supply another user's integrationId to create_or_update_user_integration() without an ownership check. SeaORM treats the supplied primary key as an update target, and the operation assigns the caller's user_id while replacing the targeted integration's provider_specifics and other configuration, which can transfer ownership, overwrite configuration, or disable the victim's integration. Exploitation requires obtaining the victim's non-brute-forceable integration id, and the vulnerable update does not disclose existing stored credential values. This issue is fixed in version 10.4.0.

Etkilenen sürümler1 yazılım

Kaynaklar6 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…a/ryot/security/advisories/GHSA-cjxv-jj8g-vfvj Diğer
• github.com/IgnisDa/ryot/pull/1797 Diğer
• github.com/…ommit/c4dffc68fc0aaf65b65c520d1d45d8da52ea8606 Diğer
• github.com/IgnisDa/ryot/releases/tag/v10.4.0 Diğer

Kayıt geçmişi

1. 7 Kas 2026 00:26Yayımlandı

İlgili açıklar

• 4,3 CVE-2026-119800Ryot: Cross-tenant collection read via `collectionContents`
• 5,9 CVE-2026-94619FileGator: Missing authorization in POST /upload allows cross-user read and deletion of temporary files
• 5,4 CVE-2026-94618FileGator: Missing authorization in GET /batchdownload allows cross-user retrieval of another user's archive
• 8,8 CVE-2026-85712Chartbrew: Cross-tenant project takeover via body.team_id in /project routes
• 6,5 CVE-2026-85737Velociraptor: Low-priv analyst reads arbitrary server files via ungated sql() VQL plugin
• 6,5 CVE-2026-634372FAuth: Missing Authorization on Share Recipients Endpoint Allows Cross-User Account Enumeration