Beveiligingsadvies

CVE-2026-33345

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-03-24 19:30:27

Laatst bijgewerkt 2026-03-25 13:21:58

Toegewezen door GitHub_M

CVSS-score 6.5

Status PUBLISHED

Beschrijving

solidtime is an open-source time-tracking app. Prior to version 0.11.6, the project detail endpoint GET /api/v1/organizations/{org}/projects/{project} allows any authenticated Employee to access any project in the organization by UUID, including private projects they are not a member of. The index() endpoint correctly applies the visibleByEmployee() scope, but show() does not. This issue has been patched in version 0.11.6.

← Alle CVE's bekijken Bekijk op cve.org ↗