CVE-2026-42092

{
  "id": "CVE-2026-42092",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-04T18:16:31.363",
  "lastModified": "2026-10-26T19:10:00.163",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "titra is an open source time tracking project. In version 0.99.52, the globalsettings Meteor publication returns all global settings without any admin or role check. Any authenticated user can subscribe via DDP and receive sensitive configuration fields such as google_secret, openai_apikey, and google_clientid. At time of publication no public patch is available."
    },
    {
      "lang": "es",
      "value": "titra es un proyecto de seguimiento de tiempo de código abierto. En la versión 0.99.52, la publicación ’globalsettings’ de Meteor devuelve todas las configuraciones globales sin ninguna verificación de administrador o rol. Cualquier usuario autenticado puede suscribirse a través de DDP y recibir campos de configuración sensibles como ’google_secret’, ’openai_apikey’ y ’google_clientid’. Al momento de la publicación, no hay ningún parche público disponible."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "titraio",
          "product": "titra",
          "versions": [
            {
              "version": "= 0.99.52",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-06T13:42:21.591120Z",
          "id": "CVE-2026-42092",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/titraio/titra/security/advisories/GHSA-4h9p-49hg-vppw",
      "source": "[email protected]"
    }
  ]
}