A low‑privileged authenticated user can supply another user’s integrationId to the createOrUpdateUserIntegration GraphQL mutation. Because the service treats the supplied ID as the target primary key, the operation assigns the caller’s user_id and replaces the victim’s provider_specifics and configuration. The result is a transfer of ownership or disabling of the victim’s integration, with no exposure of stored credential values. The weakness is a classic IDOR, classified as CWE‑639 and CWE‑862.

All releases of IgnisDa Ryot before 10.4.0 are affected. Version 10.4.0 and later incorporate an ownership check that prevents this exploit.

The CVSS score of 5.9 indicates moderate severity. Exploitation requires the attacker to know or discover a victim’s integrationId, which is not trivially brute‑forceable but could be obtained through enumeration or social engineering. EPSS data is unavailable and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited observed exploitation. Nonetheless, the potential to hijack or override another user’s integration presents a significant risk to confidentiality and integrity of that user’s data.