Search

Find a vulnerability

Search criteria

    4 vulnerabilities by IgnisDa

    CVE-2026-77442 (GCVE-0-2026-77442)

    Vulnerability from nvd – Published: 2026-11-06 21:26 – Updated: 2026-11-06 21:26
    VLAI
    Title
    Ryot: `createOrUpdateUserIntegration` trusts a client-supplied `integrationId` with no ownership check, letting any user hijack/overwrite another user's integration (cross-tenant IDOR)
    Summary
    Ryot is a self-hosted personal tracking application. Prior to 10.4.0, the createOrUpdateUserIntegration GraphQL mutation in crates/services/user/src/integration_operations.rs allows a low-privileged authenticated user to supply another user's integrationId to create_or_update_user_integration() without an ownership check. SeaORM treats the supplied primary key as an update target, and the operation assigns the caller's user_id while replacing the targeted integration's provider_specifics and other configuration, which can transfer ownership, overwrite configuration, or disable the victim's integration. Exploitation requires obtaining the victim's non-brute-forceable integration id, and the vulnerable update does not disclose existing stored credential values. This issue is fixed in version 10.4.0.
    Severity
    5.9 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L
    CWE
    • CWE-639 - Authorization Bypass Through User-Controlled Key
    • CWE-862 - Missing Authorization
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7895 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    IgnisDa ryot Affected: < 10.4.0
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "ryot",
          "vendor": "IgnisDa",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 10.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Ryot is a self-hosted personal tracking application. Prior to 10.4.0, the createOrUpdateUserIntegration GraphQL mutation in crates/services/user/src/integration_operations.rs allows a low-privileged authenticated user to supply another user\u0027s integrationId to create_or_update_user_integration() without an ownership check. SeaORM treats the supplied primary key as an update target, and the operation assigns the caller\u0027s user_id while replacing the targeted integration\u0027s provider_specifics and other configuration, which can transfer ownership, overwrite configuration, or disable the victim\u0027s integration. Exploitation requires obtaining the victim\u0027s non-brute-forceable integration id, and the vulnerable update does not disclose existing stored credential values. This issue is fixed in version 10.4.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T21:26:52.401Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/IgnisDa/ryot/security/advisories/GHSA-cjxv-jj8g-vfvj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/IgnisDa/ryot/security/advisories/GHSA-cjxv-jj8g-vfvj"
        },
        {
          "name": "https://github.com/IgnisDa/ryot/pull/1797",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/IgnisDa/ryot/pull/1797"
        },
        {
          "name": "https://github.com/IgnisDa/ryot/commit/c4dffc68fc0aaf65b65c520d1d45d8da52ea8606",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/IgnisDa/ryot/commit/c4dffc68fc0aaf65b65c520d1d45d8da52ea8606"
        },
        {
          "name": "https://github.com/IgnisDa/ryot/releases/tag/v10.4.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/IgnisDa/ryot/releases/tag/v10.4.0"
        }
      ],
      "source": {
        "advisory": "GHSA-cjxv-jj8g-vfvj",
        "discovery": "UNKNOWN"
      },
      "title": "Ryot: `createOrUpdateUserIntegration` trusts a client-supplied `integrationId` with no ownership check, letting any user hijack/overwrite another user\u0027s integration (cross-tenant IDOR)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-77442",
    "datePublished": "2026-11-06T21:26:52.401Z",
    "dateReserved": "2026-08-20T19:59:59.605Z",
    "dateUpdated": "2026-11-06T21:26:52.401Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-119800 (GCVE-0-2026-119800)

    Vulnerability from nvd – Published: 2026-11-06 21:29 – Updated: 2026-11-06 21:29
    VLAI
    Title
    Ryot: Cross-tenant collection read via `collectionContents`
    Summary
    Ryot is a self-hosted personal tracking application. Prior to 10.5.6, the collectionContents GraphQL query implemented by collection_contents() in crates/services/collection/src/content_operations.rs accepts a caller-controlled CollectionContentsInput.collection_id and returns a collection without checking whether the authenticated user owns it, collaborates on it, or may view it. The caller's user id is used only to annotate the response, allowing any authenticated user who obtains another collection's id to read the owner's identity, collection name and description, reviews, and complete item list across the tenant boundary. This issue is fixed in version 10.5.6.
    Severity
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
    CWE
    • CWE-639 - Authorization Bypass Through User-Controlled Key
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7895 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    IgnisDa ryot Affected: < 10.5.6
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "ryot",
          "vendor": "IgnisDa",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 10.5.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Ryot is a self-hosted personal tracking application. Prior to 10.5.6, the collectionContents GraphQL query implemented by collection_contents() in crates/services/collection/src/content_operations.rs accepts a caller-controlled CollectionContentsInput.collection_id and returns a collection without checking whether the authenticated user owns it, collaborates on it, or may view it. The caller\u0027s user id is used only to annotate the response, allowing any authenticated user who obtains another collection\u0027s id to read the owner\u0027s identity, collection name and description, reviews, and complete item list across the tenant boundary. This issue is fixed in version 10.5.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T21:29:32.910Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/IgnisDa/ryot/security/advisories/GHSA-pv32-9hxm-ph4v",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/IgnisDa/ryot/security/advisories/GHSA-pv32-9hxm-ph4v"
        },
        {
          "name": "https://github.com/IgnisDa/ryot/pull/1870",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/IgnisDa/ryot/pull/1870"
        },
        {
          "name": "https://github.com/IgnisDa/ryot/commit/822cc6701b46aedbc436abbf02e7efb94afd5f05",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/IgnisDa/ryot/commit/822cc6701b46aedbc436abbf02e7efb94afd5f05"
        },
        {
          "name": "https://github.com/IgnisDa/ryot/releases/tag/v10.5.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/IgnisDa/ryot/releases/tag/v10.5.6"
        }
      ],
      "source": {
        "advisory": "GHSA-pv32-9hxm-ph4v",
        "discovery": "UNKNOWN"
      },
      "title": "Ryot: Cross-tenant collection read via `collectionContents`"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-119800",
    "datePublished": "2026-11-06T21:29:32.910Z",
    "dateReserved": "2026-10-30T16:28:37.900Z",
    "dateUpdated": "2026-11-06T21:29:32.910Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-119800 (GCVE-0-2026-119800)

    Vulnerability from cvelistv5 – Published: 2026-11-06 21:29 – Updated: 2026-11-06 21:29
    VLAI
    Title
    Ryot: Cross-tenant collection read via `collectionContents`
    Summary
    Ryot is a self-hosted personal tracking application. Prior to 10.5.6, the collectionContents GraphQL query implemented by collection_contents() in crates/services/collection/src/content_operations.rs accepts a caller-controlled CollectionContentsInput.collection_id and returns a collection without checking whether the authenticated user owns it, collaborates on it, or may view it. The caller's user id is used only to annotate the response, allowing any authenticated user who obtains another collection's id to read the owner's identity, collection name and description, reviews, and complete item list across the tenant boundary. This issue is fixed in version 10.5.6.
    Severity
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
    CWE
    • CWE-639 - Authorization Bypass Through User-Controlled Key
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7895 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    IgnisDa ryot Affected: < 10.5.6
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "ryot",
          "vendor": "IgnisDa",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 10.5.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Ryot is a self-hosted personal tracking application. Prior to 10.5.6, the collectionContents GraphQL query implemented by collection_contents() in crates/services/collection/src/content_operations.rs accepts a caller-controlled CollectionContentsInput.collection_id and returns a collection without checking whether the authenticated user owns it, collaborates on it, or may view it. The caller\u0027s user id is used only to annotate the response, allowing any authenticated user who obtains another collection\u0027s id to read the owner\u0027s identity, collection name and description, reviews, and complete item list across the tenant boundary. This issue is fixed in version 10.5.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T21:29:32.910Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/IgnisDa/ryot/security/advisories/GHSA-pv32-9hxm-ph4v",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/IgnisDa/ryot/security/advisories/GHSA-pv32-9hxm-ph4v"
        },
        {
          "name": "https://github.com/IgnisDa/ryot/pull/1870",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/IgnisDa/ryot/pull/1870"
        },
        {
          "name": "https://github.com/IgnisDa/ryot/commit/822cc6701b46aedbc436abbf02e7efb94afd5f05",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/IgnisDa/ryot/commit/822cc6701b46aedbc436abbf02e7efb94afd5f05"
        },
        {
          "name": "https://github.com/IgnisDa/ryot/releases/tag/v10.5.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/IgnisDa/ryot/releases/tag/v10.5.6"
        }
      ],
      "source": {
        "advisory": "GHSA-pv32-9hxm-ph4v",
        "discovery": "UNKNOWN"
      },
      "title": "Ryot: Cross-tenant collection read via `collectionContents`"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-119800",
    "datePublished": "2026-11-06T21:29:32.910Z",
    "dateReserved": "2026-10-30T16:28:37.900Z",
    "dateUpdated": "2026-11-06T21:29:32.910Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-77442 (GCVE-0-2026-77442)

    Vulnerability from cvelistv5 – Published: 2026-11-06 21:26 – Updated: 2026-11-06 21:26
    VLAI
    Title
    Ryot: `createOrUpdateUserIntegration` trusts a client-supplied `integrationId` with no ownership check, letting any user hijack/overwrite another user's integration (cross-tenant IDOR)
    Summary
    Ryot is a self-hosted personal tracking application. Prior to 10.4.0, the createOrUpdateUserIntegration GraphQL mutation in crates/services/user/src/integration_operations.rs allows a low-privileged authenticated user to supply another user's integrationId to create_or_update_user_integration() without an ownership check. SeaORM treats the supplied primary key as an update target, and the operation assigns the caller's user_id while replacing the targeted integration's provider_specifics and other configuration, which can transfer ownership, overwrite configuration, or disable the victim's integration. Exploitation requires obtaining the victim's non-brute-forceable integration id, and the vulnerable update does not disclose existing stored credential values. This issue is fixed in version 10.4.0.
    Severity
    5.9 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L
    CWE
    • CWE-639 - Authorization Bypass Through User-Controlled Key
    • CWE-862 - Missing Authorization
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7895 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    IgnisDa ryot Affected: < 10.4.0
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "ryot",
          "vendor": "IgnisDa",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 10.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Ryot is a self-hosted personal tracking application. Prior to 10.4.0, the createOrUpdateUserIntegration GraphQL mutation in crates/services/user/src/integration_operations.rs allows a low-privileged authenticated user to supply another user\u0027s integrationId to create_or_update_user_integration() without an ownership check. SeaORM treats the supplied primary key as an update target, and the operation assigns the caller\u0027s user_id while replacing the targeted integration\u0027s provider_specifics and other configuration, which can transfer ownership, overwrite configuration, or disable the victim\u0027s integration. Exploitation requires obtaining the victim\u0027s non-brute-forceable integration id, and the vulnerable update does not disclose existing stored credential values. This issue is fixed in version 10.4.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T21:26:52.401Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/IgnisDa/ryot/security/advisories/GHSA-cjxv-jj8g-vfvj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/IgnisDa/ryot/security/advisories/GHSA-cjxv-jj8g-vfvj"
        },
        {
          "name": "https://github.com/IgnisDa/ryot/pull/1797",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/IgnisDa/ryot/pull/1797"
        },
        {
          "name": "https://github.com/IgnisDa/ryot/commit/c4dffc68fc0aaf65b65c520d1d45d8da52ea8606",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/IgnisDa/ryot/commit/c4dffc68fc0aaf65b65c520d1d45d8da52ea8606"
        },
        {
          "name": "https://github.com/IgnisDa/ryot/releases/tag/v10.4.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/IgnisDa/ryot/releases/tag/v10.4.0"
        }
      ],
      "source": {
        "advisory": "GHSA-cjxv-jj8g-vfvj",
        "discovery": "UNKNOWN"
      },
      "title": "Ryot: `createOrUpdateUserIntegration` trusts a client-supplied `integrationId` with no ownership check, letting any user hijack/overwrite another user\u0027s integration (cross-tenant IDOR)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-77442",
    "datePublished": "2026-11-06T21:26:52.401Z",
    "dateReserved": "2026-08-20T19:59:59.605Z",
    "dateUpdated": "2026-11-06T21:26:52.401Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}