CVE-2026-21695

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Titra is open source project time tracking software. In versions 0.99.49 and below, an API has a Mass Assignment vulnerability which allows authenticated users to inject arbitrary fields into time entries, bypassing business logic controls via the customfields parameter. The affected endpoint uses the JavaScript spread operator (...customfields) to merge user-controlled input directly into the database document. While customfields is validated as an Object type, there is no validation of which keys are permitted inside that object. This allows attackers to overwrite protected fields such as userId, hours, and state. The issue is fixed in version 0.99.50.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-915

Affected software

No affected versions have been published.

Timeline

Published
Jan 8, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-216966.5Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Starting in version 1.7.0 and prior to CVE-2026-216978.1axios4go is a Go HTTP client library. Prior to version 0.6.4, a race condition vulnerability exists in the shared HTTP client configuration.CVE-2026-217089.9A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user.CVE-2026-217096.7A vulnerability allowing a local attacker with administrator privileges to bypass Windows Driver Signature Enforcement.CVE-2026-21719.8A vulnerability was found in code-projects Online Student Management System 1.0. Affected is an unknown function of the file accounts.php ofCVE-2026-217107.5A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the apCVE-2026-217115.3A flaw in Node.js Permission Model network enforcement leaves Unix Domain Socket (UDS) server operations without the required permission cheCVE-2026-217126.5A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malformed internationalizedCVE-2026-217135.9A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timingCVE-2026-217145.3A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow cCVE-2026-217153.3A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, whiCVE-2026-217163.3An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permissio