CVE-2026-33345

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33345", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-18T22:15:11.813Z", "datePublished": "2026-03-24T19:30:27.471Z", "dateUpdated": "2026-03-25T13:21:58.960Z"}, "containers": {"cna": {"title": "solidtime vulnerable to IDOR in private projects", "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/solidtime-io/solidtime/security/advisories/GHSA-354j-rx28-jjxm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/solidtime-io/solidtime/security/advisories/GHSA-354j-rx28-jjxm"}, {"name": "https://github.com/solidtime-io/solidtime/commit/192c8c3b887aab34117b983c687934ca7c305209", "tags": ["x_refsource_MISC"], "url": "https://github.com/solidtime-io/solidtime/commit/192c8c3b887aab34117b983c687934ca7c305209"}, {"name": "https://github.com/solidtime-io/solidtime/releases/tag/v0.11.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/solidtime-io/solidtime/releases/tag/v0.11.6"}], "affected": [{"vendor": "solidtime-io", "product": "solidtime", "versions": [{"version": "< 0.11.6", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-24T19:30:27.471Z"}, "descriptions": [{"lang": "en", "value": "solidtime is an open-source time-tracking app. Prior to version 0.11.6, the project detail endpoint GET /api/v1/organizations/{org}/projects/{project} allows any authenticated Employee to access any project in the organization by UUID, including private projects they are not a member of. The index() endpoint correctly applies the visibleByEmployee() scope, but show() does not. This issue has been patched in version 0.11.6."}], "source": {"advisory": "GHSA-354j-rx28-jjxm", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-25T13:21:15.653150Z", "id": "CVE-2026-33345", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-25T13:21:58.960Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33345", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-18T22:15:11.813Z", "datePublished": "2026-03-24T19:30:27.471Z", "dateUpdated": "2026-03-25T13:21:58.960Z"}, "containers": {"cna": {"title": "solidtime vulnerable to IDOR in private projects", "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/solidtime-io/solidtime/security/advisories/GHSA-354j-rx28-jjxm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/solidtime-io/solidtime/security/advisories/GHSA-354j-rx28-jjxm"}, {"name": "https://github.com/solidtime-io/solidtime/commit/192c8c3b887aab34117b983c687934ca7c305209", "tags": ["x_refsource_MISC"], "url": "https://github.com/solidtime-io/solidtime/commit/192c8c3b887aab34117b983c687934ca7c305209"}, {"name": "https://github.com/solidtime-io/solidtime/releases/tag/v0.11.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/solidtime-io/solidtime/releases/tag/v0.11.6"}], "affected": [{"vendor": "solidtime-io", "product": "solidtime", "versions": [{"version": "< 0.11.6", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-24T19:30:27.471Z"}, "descriptions": [{"lang": "en", "value": "solidtime is an open-source time-tracking app. Prior to version 0.11.6, the project detail endpoint GET /api/v1/organizations/{org}/projects/{project} allows any authenticated Employee to access any project in the organization by UUID, including private projects they are not a member of. The index() endpoint correctly applies the visibleByEmployee() scope, but show() does not. This issue has been patched in version 0.11.6."}], "source": {"advisory": "GHSA-354j-rx28-jjxm", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33345", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-25T13:21:15.653150Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-25T13:21:40.910Z"}}]}}

{"affected": [{"affectedData": [{"product": "solidtime", "vendor": "solidtime-io", "versions": [{"status": "affected", "version": "< 0.11.6"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:solidtime:solidtime:*:*:*:*:*:*:*:*", "matchCriteriaId": "5F39EBFF-0C6A-407E-9FAC-7B184603B064", "versionEndExcluding": "0.11.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "solidtime is an open-source time-tracking app. Prior to version 0.11.6, the project detail endpoint GET /api/v1/organizations/{org}/projects/{project} allows any authenticated Employee to access any project in the organization by UUID, including private projects they are not a member of. The index() endpoint correctly applies the visibleByEmployee() scope, but show() does not. This issue has been patched in version 0.11.6."}, {"lang": "es", "value": "solidtime es una aplicaci\u00f3n de seguimiento de tiempo de c\u00f3digo abierto. Antes de la versi\u00f3n 0.11.6, el endpoint de detalles del proyecto GET /API/v1/organizations/{org}/projects/{project} permite a cualquier Empleado autenticado acceder a cualquier proyecto en la organizaci\u00f3n por UUID, incluyendo proyectos privados de los que no son miembros. El endpoint index() aplica correctamente el \u00e1mbito visibleByEmployee(), pero show() no lo hace. Este problema ha sido parcheado en la versi\u00f3n 0.11.6."}], "id": "CVE-2026-33345", "lastModified": "2026-06-17T10:37:21.053", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33345", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-25T13:21:15.653150Z", "version": "2.0.3"}}]}, "published": "2026-03-24T20:16:29.073", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/solidtime-io/solidtime/commit/192c8c3b887aab34117b983c687934ca7c305209"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/solidtime-io/solidtime/releases/tag/v0.11.6"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/solidtime-io/solidtime/security/advisories/GHSA-354j-rx28-jjxm"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.11.6)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "solidtime", "source": "cna", "vendor": "solidtime-io"}, "product": "solidtime", "vendor": "solidtime-io"}], "analysis": {"en": {"generated_at": "2026-03-26T15:23:27.843965+00:00", "value": {"mitigation_remediation": ["Update Solidtime to version 0.11.6 or later, where the show() endpoint has been patched.", "Verify that the access controls are functioning correctly on the API, especially that visibleByEmployee() is applied to all relevant endpoints.", "If an update cannot be applied immediately, restrict access to the project detail endpoint to a narrow set of administrators or block external API traffic until the patch is installed.", "Monitor application logs for anomalous project access attempts and audit employee permissions regularly to ensure least\u2011privilege principles are maintained."], "summary": {"action": "Immediate patch", "impact": "Unauthorized access to private project data"}, "threat_synthesis": {"affected_systems": "The affected product is Solidtime by solidtime-io. All releases prior to version 0.11.6 are vulnerable, while version 0.11.6 and later contain a fix that enforces visibility checks for project resources.", "description_and_impact": "A flaw in the project detail endpoint allows any authenticated employee to retrieve information about projects they are not a member of, exposing private data. The vulnerability is an Insecure Direct Object Reference (IDOR) that can be used to read details of sensitive projects, potentially revealing confidential work information. The CWE classification for this weakness is 639, which indicates privilege escalation through inadequate access control.", "risk_and_exploitability": "The CVSS score of 6.5 indicates a moderate impact, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in CISA\u2019s Known Exploited Vulnerabilities catalog. Attackers would need to be authenticated users of the system; they can exploit the issue simply by issuing a GET request to the vulnerable endpoint. Because the flaw permits disclosure of privileged project data, it poses a significant confidentiality risk to organizations using Solidtime."}}}}, "created": "2026-03-25T11:46:15.000395+00:00", "updated": "2026-03-27T09:20:35.379471+00:00", "vendors": ["solidtime-io", "solidtime-io$PRODUCT$solidtime"]}