CVE-2026-42092

MediumCVSS 6.5/10Last modified Oct 26, 2026

Description

titra is an open source time tracking project. In version 0.99.52, the globalsettings Meteor publication returns all global settings without any admin or role check. Any authenticated user can subscribe via DDP and receive sensitive configuration fields such as google_secret, openai_apikey, and google_clientid. At time of publication no public patch is available.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
titraio	titra	= 0.99.52

References

https://github.com/titraio/titra/security/advisories/GHSA-4h9p-49hg-vppw

Timeline

Published: May 4, 2026
Last modified: Oct 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-420938.7Redash is a package for data visualization and sharing. From versions after 8.0.0 until 26.9.0, the Query Results query runner in redash/que CVE-2026-420954.0bookserver in KDE Arianna before 26.04.1 allows attackers to read files over a socket connection by guessing a URL.CVE-2026-420968.8Sparx Pro Cloud Server is vulnerable to Broken Access Control within communication with the database. Due to lack of permission checks, any CVE-2026-420978.8Sparx Pro Cloud Server requires authentication based on requested URL. An attacker can omit the "model" query parameter and send the model n CVE-2026-420988.7Sparx Enterprise Architect software has a security feature that limits user's actions to those specified in the role. An authenticated attac CVE-2026-420997.5Sparx Pro Cloud Server is vulnerable to a Race Condition in the /data_api/dl_internal_artifact.php endpoint. The application downloads the p CVE-2026-42109.8A security flaw has been discovered in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325 CVE-2026-421007.5Improper Handling of Syntactically Invalid Structure in Sparx Pro Cloud Server allows Denial of Service (DoS) attack to be executed by sendi CVE-2026-42119.8A weakness has been identified in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS CVE-2026-42129.8A security vulnerability has been detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, CVE-2026-421277.5The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excess CVE-2026-421297.7A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensi