ryot

v10.4.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 13d Dashboards & Home Pages

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

exercise-tracker fitness-tracker integrations media-tracking tracker

Affected surfaces

auth rbac

ReleasePort's take

Moderate signal

editorial:auto 12d

Version v10.4.0 fixes an IDOR vulnerability that enabled hijacking or overwriting another user's integration API.

Why it matters: The release patches a critical (severity 95) IDOR flaw affecting the integration API; operators should upgrade immediately to prevent unauthorized account takeover.

Summary

AI summary

Fixed an IDOR vulnerability that allowed users to hijack or overwrite another user's integration.

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	Fixes IDOR vulnerability allowing hijack/overwrite of another user's integration. Fixes IDOR vulnerability allowing hijack/overwrite of another user's integration. Source: llm_adapter@2026-07-14 Confidence: high	—

Full changelog

Updates in this release

Addressed a IDOR (Insecure Direct Object References) bug wherein a user can hijack/overwrite another user's integration. Thanks to 5ud0 / Tarmo Technologies (@5ud0er) for reporting this.

Security Fixes

IDOR vulnerability fixed – prevented hijacking/overwriting of another user's integration

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track ryot

Get notified when new releases ship.

About ryot

Roll your own tracker!

All releases →

Related context

Related tools

Earlier breaking changes

v10.3.18 Removes Moon build system and migrates to Turbo.