CVE-2026-42092

CVSS Score & Metrics

Base Score

6.5 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N                                    

Vulnerability Description

titra is an open source time tracking project. In version 0.99.52, the globalsettings Meteor publication returns all global settings without any admin or role check. Any authenticated user can subscribe via DDP and receive sensitive configuration fields such as google_secret, openai_apikey, and google_clientid. At time of publication no public patch is available.

Vulnerability Details

Published Date

May 04, 2026

Last Modified

May 07, 2026

CWE ID

CWE-200

Source

NVD

Vendor

titraio

Product

titra

External References

https://github.com/titraio/titra/security/advisories/GHSA-4h9p-49hg-vppw

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment