CVE-2026-77442 Ryot: `createOrUpdateUserIntegration` trusts a client-supplied `integrationId` with no ownership check, letting any user hijack/overwrite another user's integration (cross-tenant IDOR)

Ryot is a self-hosted personal tracking application. Prior to 10.4.0, the createOrUpdateUserIntegration GraphQL mutation in crates/services/user/src/integrationoperations.rs allows a low-privileged authenticated user to supply another user's integrationId to createorupdateuserintegration without ...