Skip to content
OpenAdvisories

Vendor

titraio

2 known vulnerabilities.

Products

titra 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-63497

    titra: residual mass assignment via customfields in timeentry/create and project/task/create

    titra is an open source time tracking project. In versions 1.0.3 and prior, authenticated API users can abuse the customfields object to inject or overwrite top-level fields in MongoDB documents. At time of publication, there are no publicly known patches.

    titraio titra
  • Medium 6.5
    CVE-2026-42092

    Global Settings Publication Exposes Sensitive Configuration to Any Authenticated User in Titra

    titra is an open source time tracking project. In version 0.99.52, the globalsettings Meteor publication returns all global settings without any admin or role check. Any authenticated user can subscribe via DDP and receive sensitive configuration fields such …

    titraio titra