PT-2026-38663 · Solidtime · Solidtime

Pyuysig · Published 2026-05-08 · Updated 2026-05-09 · CVE-2026-42279

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions solidtime version 0.12.0

Description An issue exists where the 'PUT /api/v1/organizations/{organization}/time-entries/{timeEntry}' API accepts a route-bound timeEntry from a different organization. This occurs when the caller possesses the time-entries:update:all permission within the organization specified in the URL, enabling a known foreign time-entry UUID to be modified and rebound to objects within the caller's own organization.

Recommendations Update to version 0.12.1.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-42279

Affected Products

Solidtime

References · 7

• 🔥 https://github.com/solidtime-io/solidtime/security/advisories/GHSA-pmf9-pxq9-ccwr · Exploit
• https://github.com/solidtime-io/solidtime/commit/b73aa543fdf5b61c37447307ab7277451296832c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-42279 · Security Note
• https://github.com/solidtime-io/solidtime/releases/tag/v0.12.1 · Note
• https://twitter.com/VulmonFeeds/status/2052694069281706180 · Twitter Post
• https://t.me/cveNotify/162696 · Telegram Post
• https://twitter.com/CVEnew/status/2053174700604346474 · Twitter Post