Security Advisory

CVE-2026-42092

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-05-04 17:30:46

Last updated 2026-05-06 13:42:39

Assigner GitHub_M

CVSS score 6.5

State PUBLISHED

Description

titra is an open source time tracking project. In version 0.99.52, the globalsettings Meteor publication returns all global settings without any admin or role check. Any authenticated user can subscribe via DDP and receive sensitive configuration fields such as google_secret, openai_apikey, and google_clientid. At time of publication no public patch is available.

← Browse all CVEs View on cve.org ↗