CVE-2026-42092

MediumCVSS 6.5

Published: 04/05/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

12th percentile - higher than 12% of all known CVEs

Summary

In titra version 0.99.52, the globalsettings Meteor publication returns all global settings without any admin or role check. Any authenticated user can subscribe via DDP and receive sensitive configuration fields such as google_secret, openai_apikey, and google_clientid. No public patch is available at the time of publication.

Risk Assessment

A low-privileged authenticated user can obtain API keys and secrets, potentially leading to unauthorized use of external services and costs. Secret leakage may also enable further attacks.

Recommendation

Restrict the globalsettings publication to administrators and remove sensitive fields from the DDP subscription. Until patched, rotate exposed API keys and monitor their usage.

Other vulnerabilities in titra

CVE-2025-69288Critical
Titra is open source project time tracking software. Prior to version 0.99.49, any authenticated Admin user can modify the timeEntryRule in the database. The value is then passed to a NodeVM to execute as code. Without sanitization, it leads to Remote Code Execution. Version 0.99.49 fixes the issue.

Original NVD description (English source)

titra is an open source time tracking project. In version 0.99.52, the globalsettings Meteor publication returns all global settings without any admin or role check. Any authenticated user can subscribe via DDP and receive sensitive configuration fields such as google_secret, openai_apikey, and google_clientid. At time of publication no public patch is available.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS