CVE-2026-42279

Katalog CVE

CVSS 5.8 · Medium EPSS 0,38%

Kerentanan Authorization Bypass Through User-Controlled Key pada solidtime. Skor CVSS 3.1 5.8 (Medium) menurut github.com.

Deskripsi (NVD)

solidtime is an open-source time-tracking app. In version 0.12.0, the PUT /api/v1/organizations/{organization}/time-entries/{timeEntry} API accepts a route-bound timeEntry from another organization when the caller has time-entries:update:all in the URL organization, allowing a known foreign time-entry UUID to be modified and rebound to objects in the caller's organization. This issue has been patched in version 0.12.1.

Rincian

Terbit di NVD

8 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.8 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,38% peluang dieksploitasi; lebih tinggi dari 29,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/solidtime-io/solidtime/security/advisories/GHSA-pmf9-pxq9-ccwr exploit · advisory vendor
• https://github.com/solidtime-io/solidtime/commit/b73aa543fdf5b61c37447307ab7277451296832c patch
• https://github.com/solidtime-io/solidtime/releases/tag/v0.12.1 product · release notes