Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2026-42279

Summary
Assigner-GitHub_M
Assigner Org ID-a0819718-46f1-4df5-94e2-005712e83aaa
Published At-08 May, 2026 | 03:57
Updated At-08 May, 2026 | 03:57
Rejected At-
Credits

solidtime: Time entry update endpoint allows cross-organization modification of a known time-entry UUID

solidtime is an open-source time-tracking app. In version 0.12.0, the PUT /api/v1/organizations/{organization}/time-entries/{timeEntry} API accepts a route-bound timeEntry from another organization when the caller has time-entries:update:all in the URL organization, allowing a known foreign time-entry UUID to be modified and rebound to objects in the caller's organization. This issue has been patched in version 0.12.1.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:GitHub_M
Assigner Org ID:a0819718-46f1-4df5-94e2-005712e83aaa
Published At:08 May, 2026 | 03:57
Updated At:08 May, 2026 | 03:57
Rejected At:
▼CVE Numbering Authority (CNA)
solidtime: Time entry update endpoint allows cross-organization modification of a known time-entry UUID

solidtime is an open-source time-tracking app. In version 0.12.0, the PUT /api/v1/organizations/{organization}/time-entries/{timeEntry} API accepts a route-bound timeEntry from another organization when the caller has time-entries:update:all in the URL organization, allowing a known foreign time-entry UUID to be modified and rebound to objects in the caller's organization. This issue has been patched in version 0.12.1.

Affected Products
Vendor
solidtime-io
Product
solidtime
Versions
Affected
  • = 0.12.0
Problem Types
TypeCWE IDDescription
CWECWE-639CWE-639: Authorization Bypass Through User-Controlled Key
Type: CWE
CWE ID: CWE-639
Description: CWE-639: Authorization Bypass Through User-Controlled Key
Metrics
VersionBase scoreBase severityVector
3.15.8MEDIUM
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N
Version: 3.1
Base score: 5.8
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://github.com/solidtime-io/solidtime/security/advisories/GHSA-pmf9-pxq9-ccwr
x_refsource_CONFIRM
https://github.com/solidtime-io/solidtime/commit/b73aa543fdf5b61c37447307ab7277451296832c
x_refsource_MISC
https://github.com/solidtime-io/solidtime/releases/tag/v0.12.1
x_refsource_MISC
Hyperlink: https://github.com/solidtime-io/solidtime/security/advisories/GHSA-pmf9-pxq9-ccwr
Resource:
x_refsource_CONFIRM
Hyperlink: https://github.com/solidtime-io/solidtime/commit/b73aa543fdf5b61c37447307ab7277451296832c
Resource:
x_refsource_MISC
Hyperlink: https://github.com/solidtime-io/solidtime/releases/tag/v0.12.1
Resource:
x_refsource_MISC
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:security-advisories@github.com
Published At:08 May, 2026 | 05:16
Updated At:08 May, 2026 | 11:16

solidtime is an open-source time-tracking app. In version 0.12.0, the PUT /api/v1/organizations/{organization}/time-entries/{timeEntry} API accepts a route-bound timeEntry from another organization when the caller has time-entries:update:all in the URL organization, allowing a known foreign time-entry UUID to be modified and rebound to objects in the caller's organization. This issue has been patched in version 0.12.1.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary3.15.8MEDIUM
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N
Type: Secondary
Version: 3.1
Base score: 5.8
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N
CPE Matches
Weaknesses
CWE IDTypeSource
CWE-639Secondarysecurity-advisories@github.com
CWE ID: CWE-639
Type: Secondary
Source: security-advisories@github.com
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://github.com/solidtime-io/solidtime/commit/b73aa543fdf5b61c37447307ab7277451296832csecurity-advisories@github.com
N/A
https://github.com/solidtime-io/solidtime/releases/tag/v0.12.1security-advisories@github.com
N/A
https://github.com/solidtime-io/solidtime/security/advisories/GHSA-pmf9-pxq9-ccwrsecurity-advisories@github.com
N/A
https://github.com/solidtime-io/solidtime/security/advisories/GHSA-pmf9-pxq9-ccwr134c704f-9b21-4f2e-91b3-4a467353bcc0
N/A
Hyperlink: https://github.com/solidtime-io/solidtime/commit/b73aa543fdf5b61c37447307ab7277451296832c
Source: security-advisories@github.com
Resource: N/A
Hyperlink: https://github.com/solidtime-io/solidtime/releases/tag/v0.12.1
Source: security-advisories@github.com
Resource: N/A
Hyperlink: https://github.com/solidtime-io/solidtime/security/advisories/GHSA-pmf9-pxq9-ccwr
Source: security-advisories@github.com
Resource: N/A
Hyperlink: https://github.com/solidtime-io/solidtime/security/advisories/GHSA-pmf9-pxq9-ccwr
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Resource: N/A

Change History

0
Information is not available yet

Similar CVEs

1Records found
CVE-2026-33345
Matching Score-6
Assigner-GitHub, Inc.
ShareView Details
Matching Score-6
Assigner-GitHub, Inc.
CVSS Score-6.5||MEDIUM
EPSS-0.01% / 2.70%
||
7 Day CHG~0.00%
Published-24 Mar, 2026 | 19:30
Updated-26 Mar, 2026 | 13:21
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
solidtime vulnerable to IDOR in private projects

solidtime is an open-source time-tracking app. Prior to version 0.11.6, the project detail endpoint GET /api/v1/organizations/{org}/projects/{project} allows any authenticated Employee to access any project in the organization by UUID, including private projects they are not a member of. The index() endpoint correctly applies the visibleByEmployee() scope, but show() does not. This issue has been patched in version 0.11.6.

Action-Not Available
Vendor-solidtimesolidtime-io
Product-solidtimesolidtime
CWE ID-CWE-639
Authorization Bypass Through User-Controlled Key
Details not found