Titra is open source project time tracking software. In versions 0.99.49 and below, an API has a Mass Assignment vulnerability which allows authenticated users to inject arbitrary fields into time entries, bypassing business logic controls via the customfields parameter. The affected endpoint uses the JavaScript spread operator (...customfields) to merge user-controlled input directly into the database document. While customfields is validated as an Object type, there is no validation of which keys are permitted inside that object. This allows attackers to overwrite protected fields such as userId, hours, and state. The issue is fixed in version 0.99.50.
References
| Link | Resource |
|---|---|
| https://github.com/kromitgmbh/titra/commit/29e6b88eca005107729e45a6f1731cf0fa5f8938 | Patch |
| https://github.com/kromitgmbh/titra/security/advisories/GHSA-gc65-vr47-jppq | Exploit Vendor Advisory |
| https://github.com/kromitgmbh/titra/security/advisories/GHSA-gc65-vr47-jppq | Exploit Vendor Advisory |
Configurations
History
12 Jan 2026, 18:40
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/kromitgmbh/titra/commit/29e6b88eca005107729e45a6f1731cf0fa5f8938 - Patch | |
| References | () https://github.com/kromitgmbh/titra/security/advisories/GHSA-gc65-vr47-jppq - Exploit, Vendor Advisory | |
| First Time |
Kromit titra
Kromit |
|
| CPE | cpe:2.3:a:kromit:titra:*:*:*:*:*:*:*:* |
08 Jan 2026, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/kromitgmbh/titra/security/advisories/GHSA-gc65-vr47-jppq - |
08 Jan 2026, 00:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-08 00:15
Updated : 2026-01-12 18:40
NVD link : CVE-2026-21695
Mitre link : CVE-2026-21695
CVE.ORG link : CVE-2026-21695
JSON object : View
Products Affected
kromit
- titra
CWE
CWE-915
Improperly Controlled Modification of Dynamically-Determined Object Attributes