CVE-2026-33345

MEDIUM EPSS 33.3%
Published Mar 24, 20263mo ago · Modified Jun 17, 20262w ago
6.5 CVSS 3.1
Medium
Find Similar
Published Mar 24, 2026 3mo ago
Last Modified Jun 17, 2026 2w ago

Description

solidtime is an open-source time-tracking app. Prior to version 0.11.6, the project detail endpoint GET /api/v1/organizations/{org}/projects/{project} allows any authenticated Employee to access any project in the organization by UUID, including private projects they are not a member of. The index() endpoint correctly applies the visibleByEmployee() scope, but show() does not. This issue has been patched in version 0.11.6.

CVSS Details

Base Score
6.5
Exploitability
2.8
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
33.3% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-639

Affected Products 1

VendorProductVersionRange
solidtimesolidtime* <0.11.6

References 3

  • github.com https://github.com/solidtime-io/solidtime/commit/192c8c3b887aab34117b983c687934ca7c305209
    Patch
  • github.com https://github.com/solidtime-io/solidtime/releases/tag/v0.11.6
    ProductRelease Notes
  • github.com https://github.com/solidtime-io/solidtime/security/advisories/GHSA-354j-rx28-jjxm
    ExploitMitigationVendor Advisory

Remediation

  • github.com https://github.com/solidtime-io/solidtime/commit/192c8c3b887aab34117b983c687934ca7c305209
    Patch