CVE-2026-21695

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21695", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-02T18:45:27.397Z", "datePublished": "2026-01-07T23:19:01.616Z", "dateUpdated": "2026-01-08T18:16:33.468Z"}, "containers": {"cna": {"title": "Titra API Contains Mass Assignment Vulnerability", "problemTypes": [{"descriptions": [{"cweId": "CWE-915", "lang": "en", "description": "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/kromitgmbh/titra/security/advisories/GHSA-gc65-vr47-jppq", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/kromitgmbh/titra/security/advisories/GHSA-gc65-vr47-jppq"}, {"name": "https://github.com/kromitgmbh/titra/commit/29e6b88eca005107729e45a6f1731cf0fa5f8938", "tags": ["x_refsource_MISC"], "url": "https://github.com/kromitgmbh/titra/commit/29e6b88eca005107729e45a6f1731cf0fa5f8938"}], "affected": [{"vendor": "kromitgmbh", "product": "titra", "versions": [{"version": "< 0.99.50", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-07T23:19:01.616Z"}, "descriptions": [{"lang": "en", "value": "Titra is open source project time tracking software. In versions 0.99.49 and below, an API has a Mass Assignment vulnerability which allows authenticated users to inject arbitrary fields into time entries, bypassing business logic controls via the customfields parameter. The affected endpoint uses the JavaScript spread operator (...customfields) to merge user-controlled input directly into the database document. While customfields is validated as an Object type, there is no validation of which keys are permitted inside that object. This allows attackers to overwrite protected fields such as userId, hours, and state. The issue is fixed in version 0.99.50."}], "source": {"advisory": "GHSA-gc65-vr47-jppq", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/kromitgmbh/titra/security/advisories/GHSA-gc65-vr47-jppq", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-08T15:06:15.389331Z", "id": "CVE-2026-21695", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-08T18:16:33.468Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21695", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-08T15:06:15.389331Z"}}}], "references": [{"url": "https://github.com/kromitgmbh/titra/security/advisories/GHSA-gc65-vr47-jppq", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-08T15:06:17.677Z"}}], "cna": {"title": "Titra API Contains Mass Assignment Vulnerability", "source": {"advisory": "GHSA-gc65-vr47-jppq", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "kromitgmbh", "product": "titra", "versions": [{"status": "affected", "version": "< 0.99.50"}]}], "references": [{"url": "https://github.com/kromitgmbh/titra/security/advisories/GHSA-gc65-vr47-jppq", "name": "https://github.com/kromitgmbh/titra/security/advisories/GHSA-gc65-vr47-jppq", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/kromitgmbh/titra/commit/29e6b88eca005107729e45a6f1731cf0fa5f8938", "name": "https://github.com/kromitgmbh/titra/commit/29e6b88eca005107729e45a6f1731cf0fa5f8938", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Titra is open source project time tracking software. In versions 0.99.49 and below, an API has a Mass Assignment vulnerability which allows authenticated users to inject arbitrary fields into time entries, bypassing business logic controls via the customfields parameter. The affected endpoint uses the JavaScript spread operator (...customfields) to merge user-controlled input directly into the database document. While customfields is validated as an Object type, there is no validation of which keys are permitted inside that object. This allows attackers to overwrite protected fields such as userId, hours, and state. The issue is fixed in version 0.99.50."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-915", "description": "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-07T23:19:01.616Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21695", "state": "PUBLISHED", "dateUpdated": "2026-01-08T18:16:33.468Z", "dateReserved": "2026-01-02T18:45:27.397Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-07T23:19:01.616Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "titra", "vendor": "kromitgmbh", "versions": [{"status": "affected", "version": "< 0.99.50"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:kromit:titra:*:*:*:*:*:*:*:*", "matchCriteriaId": "271EC7B1-5D87-473E-A67A-C9DCE59DA114", "versionEndExcluding": "0.99.50", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Titra is open source project time tracking software. In versions 0.99.49 and below, an API has a Mass Assignment vulnerability which allows authenticated users to inject arbitrary fields into time entries, bypassing business logic controls via the customfields parameter. The affected endpoint uses the JavaScript spread operator (...customfields) to merge user-controlled input directly into the database document. While customfields is validated as an Object type, there is no validation of which keys are permitted inside that object. This allows attackers to overwrite protected fields such as userId, hours, and state. The issue is fixed in version 0.99.50."}, {"lang": "es", "value": "Titra es un software de seguimiento de tiempo de proyectos de c\u00f3digo abierto. En las versiones 0.99.49 e inferiores, una API tiene una vulnerabilidad de Asignaci\u00f3n Masiva que permite a los usuarios autenticados inyectar campos arbitrarios en las entradas de tiempo, eludiendo los controles de l\u00f3gica de negocio a trav\u00e9s del par\u00e1metro customfields. El endpoint afectado utiliza el operador de propagaci\u00f3n de JavaScript (...customfields) para fusionar la entrada controlada por el usuario directamente en el documento de la base de datos. Aunque customfields se valida como un tipo de Objeto, no hay validaci\u00f3n de qu\u00e9 claves est\u00e1n permitidas dentro de ese objeto. Esto permite a los atacantes sobrescribir campos protegidos como userId, hours y state. El problema est\u00e1 solucionado en la versi\u00f3n 0.99.50."}], "id": "CVE-2026-21695", "lastModified": "2026-06-17T10:18:56.537", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21695", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-08T15:06:15.389331Z", "version": "2.0.3"}}]}, "published": "2026-01-08T00:15:59.833", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/kromitgmbh/titra/commit/29e6b88eca005107729e45a6f1731cf0fa5f8938"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/kromitgmbh/titra/security/advisories/GHSA-gc65-vr47-jppq"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/kromitgmbh/titra/security/advisories/GHSA-gc65-vr47-jppq"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-915"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T07:51:59.704114+00:00", "value": {"mitigation_remediation": ["Ensure the Titra installation is upgraded to version 0.99.50 or later; obtain the latest release from the official repository or project site.", "Verify that the upgraded instance no longer accepts arbitrary customfields by attempting to modify a protected field such as userId or hours and confirming the operation fails.", "Apply any additional access controls recommended by the vendor\u2014for example, restrict API permissions to only those roles that legitimately require time\u2011entry updates\u2014to reduce the attack surface until the patch is fully deployed."], "summary": {"action": "Immediate Patch", "impact": "Privilege Escalation via Arbitrary Field Injection"}, "threat_synthesis": {"affected_systems": "The issue affects Titra, an open\u2011source time\u2011tracking application developed by kromitgmbh, in all releases up to and including 0.99.49. The vulnerability is fixed in version 0.99.50 and later.", "description_and_impact": "Titra versions 0.99.49 and earlier have a mass\u2011assignment flaw that allows an authenticated API user to insert arbitrary fields into time\u2011entry documents via the customfields parameter. The JavaScript spread operator directly merges the user\u2011supplied object into the database record without validating which keys are permitted. Attackers can therefore modify protected attributes such as userId, hours, and state, effectively hijacking time entries and potentially gaining unauthorized control over user accounts. This weakness corresponds to CWE\u2011915, \u201cArbitrary Update to Data Object.\u201d", "risk_and_exploitability": "The CVSS score is 4.3, indicating a moderate severity vulnerability. The EPSS score is less than 1\u202f%, suggesting a low likelihood of exploitation in the wild, and the flaw is not listed in the CISA KEV catalog. Exploitation requires a valid authenticated session with access to the affected API endpoint; an attacker would need to build a payload that injects disallowed fields into the customfields object. Once executed, the attacker could modify secured fields to affect account ownership, billing, or project time logs."}}}}, "created": "2026-01-08T09:47:58.252559+00:00", "updated": "2026-04-18T08:00:05.791323+00:00", "vendors": ["kromit", "kromit$PRODUCT$titra"]}