Titra · Titra · CVE-2026-21695
**Name of the Vulnerable Software and Affected Versions**
Titra versions 0.99.49 and below
**Description**
Titra is open source project time tracking software. An API has a Mass Assignment issue that allows authenticated users to inject arbitrary fields into time entries, bypassing business logic controls via the `customfields` parameter. The affected endpoint uses the JavaScript spread operator (...`customfields`) to merge user-controlled input directly into the database document. While `customfields` is validated as an Object type, there is no validation of which keys are permitted inside that object. This allows attackers to overwrite protected fields such as `userId`, `hours`, and `state`.
**Recommendations**
Update to version 0.99.50 or later.