CVE-2026-21694

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21694", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-02T18:45:27.397Z", "datePublished": "2026-01-07T23:10:48.362Z", "dateUpdated": "2026-01-08T19:23:48.439Z"}, "containers": {"cna": {"title": "Titra APIs have Improper Access Control", "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "lang": "en", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/kromitgmbh/titra/security/advisories/GHSA-mr2r-wjf8-cj3c", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/kromitgmbh/titra/security/advisories/GHSA-mr2r-wjf8-cj3c"}, {"name": "https://github.com/kromitgmbh/titra/commit/29e6b88eca005107729e45a6f1731cf0fa5f8938", "tags": ["x_refsource_MISC"], "url": "https://github.com/kromitgmbh/titra/commit/29e6b88eca005107729e45a6f1731cf0fa5f8938"}], "affected": [{"vendor": "kromitgmbh", "product": "titra", "versions": [{"version": "< 0.99.50", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-07T23:10:48.362Z"}, "descriptions": [{"lang": "en", "value": "Titra is open source project time tracking software. Versions 0.99.49 and below have Improper Access Control, allowing users to view and edit other users' time entries in private projects they have not been granted access to. This issue is fixed in version 0.99.50."}], "source": {"advisory": "GHSA-mr2r-wjf8-cj3c", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/kromitgmbh/titra/security/advisories/GHSA-mr2r-wjf8-cj3c", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-08T19:23:45.425198Z", "id": "CVE-2026-21694", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-08T19:23:48.439Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21694", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-08T19:23:45.425198Z"}}}], "references": [{"url": "https://github.com/kromitgmbh/titra/security/advisories/GHSA-mr2r-wjf8-cj3c", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-08T19:23:41.277Z"}}], "cna": {"title": "Titra APIs have Improper Access Control", "source": {"advisory": "GHSA-mr2r-wjf8-cj3c", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "kromitgmbh", "product": "titra", "versions": [{"status": "affected", "version": "< 0.99.50"}]}], "references": [{"url": "https://github.com/kromitgmbh/titra/security/advisories/GHSA-mr2r-wjf8-cj3c", "name": "https://github.com/kromitgmbh/titra/security/advisories/GHSA-mr2r-wjf8-cj3c", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/kromitgmbh/titra/commit/29e6b88eca005107729e45a6f1731cf0fa5f8938", "name": "https://github.com/kromitgmbh/titra/commit/29e6b88eca005107729e45a6f1731cf0fa5f8938", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Titra is open source project time tracking software. Versions 0.99.49 and below have Improper Access Control, allowing users to view and edit other users' time entries in private projects they have not been granted access to. This issue is fixed in version 0.99.50."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-07T23:10:48.362Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21694", "state": "PUBLISHED", "dateUpdated": "2026-01-08T19:23:48.439Z", "dateReserved": "2026-01-02T18:45:27.397Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-07T23:10:48.362Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "titra", "vendor": "kromitgmbh", "versions": [{"status": "affected", "version": "< 0.99.50"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:kromit:titra:*:*:*:*:*:*:*:*", "matchCriteriaId": "271EC7B1-5D87-473E-A67A-C9DCE59DA114", "versionEndExcluding": "0.99.50", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Titra is open source project time tracking software. Versions 0.99.49 and below have Improper Access Control, allowing users to view and edit other users' time entries in private projects they have not been granted access to. This issue is fixed in version 0.99.50."}, {"lang": "es", "value": "Titra es un software de seguimiento de tiempo de proyectos de c\u00f3digo abierto. Las versiones 0.99.49 e inferiores tienen un Control de Acceso Inadecuado, permitiendo a los usuarios ver y editar las entradas de tiempo de otros usuarios en proyectos privados a los que no se les ha concedido acceso. Este problema se ha solucionado en la versi\u00f3n 0.99.50."}], "id": "CVE-2026-21694", "lastModified": "2026-06-17T10:18:56.423", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21694", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-08T19:23:45.425198Z", "version": "2.0.3"}}]}, "published": "2026-01-08T00:15:59.680", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/kromitgmbh/titra/commit/29e6b88eca005107729e45a6f1731cf0fa5f8938"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/kromitgmbh/titra/security/advisories/GHSA-mr2r-wjf8-cj3c"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/kromitgmbh/titra/security/advisories/GHSA-mr2r-wjf8-cj3c"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T16:47:01.588316+00:00", "value": {"mitigation_remediation": ["Upgrade the Titra installation to version 0.99.50 or later to apply the vendor fix that enforces proper access control on API endpoints.", "Verify that the API routes checking project visibility and user permissions are active, and reconfigure them if necessary to restrict read and write access to only users with explicit project rights.", "Conduct a thorough audit of user roles and permissions within Titra, removing any users who possess broader project access than required for their job functions."], "summary": {"action": "Patch", "impact": "Unauthorized access to private time entries"}, "threat_synthesis": {"affected_systems": "The flaw affects the open\u2011source Titra time\u2011tracking application from kromitgmbh. All releases up to and including 0.99.49 are vulnerable; the issue is resolved in 0.99.50.", "description_and_impact": "The vulnerability is an improper access control flaw that allows authenticated users to view and edit time entries belonging to other users in private projects. This leads to confidentiality leakage and integrity compromise, enabling the attacker to read or modify sensitive work logs.", "risk_and_exploitability": "The CVSS score of 6.8 indicates moderate severity, and the EPSS score of less than 1% suggests a low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by accessing the exposed API endpoints while authenticated, implying a remote attack vector that requires legitimate credentials but does not involve code execution."}}}}, "created": "2026-01-08T09:47:49.858746+00:00", "updated": "2026-04-18T17:00:05.560483+00:00", "vendors": ["kromit", "kromit$PRODUCT$titra"]}