CVE-2026-21694

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Titra is open source project time tracking software. Versions 0.99.49 and below have Improper Access Control, allowing users to view and edit other users' time entries in private projects they have not been granted access to. This issue is fixed in version 0.99.50.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Jan 8, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-216954.3Titra is open source project time tracking software. In versions 0.99.49 and below, an API has a Mass Assignment vulnerability which allows CVE-2026-216966.5Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Starting in version 1.7.0 and prior to CVE-2026-216978.1axios4go is a Go HTTP client library. Prior to version 0.6.4, a race condition vulnerability exists in the shared HTTP client configuration.CVE-2026-217089.9A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user.CVE-2026-217096.7A vulnerability allowing a local attacker with administrator privileges to bypass Windows Driver Signature Enforcement.CVE-2026-21719.8A vulnerability was found in code-projects Online Student Management System 1.0. Affected is an unknown function of the file accounts.php of CVE-2026-217107.5A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the ap CVE-2026-217115.3A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission che CVE-2026-217126.5A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malformed internationalized CVE-2026-217135.9A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing CVE-2026-217145.3A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow c CVE-2026-217153.3A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, whi