PT-2026-2092 · Titra · Titra

Alakinnn · Publicado 2026-01-07 · Atualizado 2026-01-08 · CVE-2026-21695

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Titra versions 0.99.49 and below

Description Titra is open source project time tracking software. An API has a Mass Assignment issue that allows authenticated users to inject arbitrary fields into time entries, bypassing business logic controls via the customfields parameter. The affected endpoint uses the JavaScript spread operator (...customfields) to merge user-controlled input directly into the database document. While customfields is validated as an Object type, there is no validation of which keys are permitted inside that object. This allows attackers to overwrite protected fields such as userId, hours, and state.

Recommendations Update to version 0.99.50 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-915

Identificadores relacionados

CVE-2026-21695

GHSA-GC65-VR47-JPPQ

Produtos afetados

Titra

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21695.json · Exploit
• 🔥 https://github.com/kromitgmbh/titra/security/advisories/GHSA-gc65-vr47-jppq · Exploit
• https://github.com/kromitgmbh/titra/commit/29e6b88eca005107729e45a6f1731cf0fa5f8938 · Correção
• https://twitter.com/VulmonFeeds/status/2009155073952055752 · Publicação no Twitter
• https://t.me/CVEtracker/41659 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-21695 · Nota de Segurança
• https://twitter.com/CVEnew/status/2009149988132278692 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-21695 · Aviso do Fabricante