PT-2026-2092 · Titra · Titra

Alakinnn · Published 2026-01-07 · Updated 2026-01-08 · CVE-2026-21695

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Titra versions 0.99.49 and below

Description Titra is open source project time tracking software. An API has a Mass Assignment issue that allows authenticated users to inject arbitrary fields into time entries, bypassing business logic controls via the customfields parameter. The affected endpoint uses the JavaScript spread operator (...customfields) to merge user-controlled input directly into the database document. While customfields is validated as an Object type, there is no validation of which keys are permitted inside that object. This allows attackers to overwrite protected fields such as userId, hours, and state.

Recommendations Update to version 0.99.50 or later.

Exploit

Fix

Weakness Enumeration

CWE-915

Related Identifiers

CVE-2026-21695

GHSA-GC65-VR47-JPPQ

Affected Products

Titra

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21695.json · Exploit
• 🔥 https://github.com/kromitgmbh/titra/security/advisories/GHSA-gc65-vr47-jppq · Exploit
• https://github.com/kromitgmbh/titra/commit/29e6b88eca005107729e45a6f1731cf0fa5f8938 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-21695 · Security Note
• https://osv.dev/vulnerability/CVE-2026-21695 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2009155073952055752 · Twitter Post
• https://t.me/CVEtracker/41659 · Telegram Post
• https://twitter.com/CVEnew/status/2009149988132278692 · Twitter Post