CVE-2026-42092: Global Settings Publication Exposes Sensitive Configuration to Any Authenticated User in Titra
titra is an open source time tracking project. In version 0.99.52, the globalsettings Meteor publication returns all global settings without any admin or role check. Any authenticated user can subscribe via DDP and receive sensitive configuration fields such as googlesecret, openaiapikey, and googleclientid. At time of publication no public patch is available.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42092?
CVE-2026-42092 has been classified as a low to medium severity vulnerability due to the exposure of sensitive configuration data.
How do I fix CVE-2026-42092?
To mitigate CVE-2026-42092, update to version 0.99.53 or later of Titra, which includes proper role checks on global settings publication.
Who is affected by CVE-2026-42092?
The vulnerability affects users of Titra version 0.99.52 who are authenticated and can subscribe to publications.
What type of vulnerability is CVE-2026-42092?
CVE-2026-42092 is an information exposure vulnerability that allows authenticated users to access sensitive configuration settings.
Can CVE-2026-42092 be exploited by unauthenticated users?
No, CVE-2026-42092 can only be exploited by authenticated users due to the lack of role and permission checks.