GHSA-cphv-qx83-x397: titra: residual mass assignment via customfields in timeentry/create and project/task/create
Published Nov 9, 2026
·Updated
titra is an open source time tracking project. In versions 1.0.3 and prior, authenticated API users can abuse the customfields object to inject or overwrite top-level fields in MongoDB documents. At time of publication, there are no publicly known patches.
Affected Software
1 affected component
Titra Titra<=1.0.3
Event History
Nov 9, 2026
CVE Published
via OSV·08:52 PM
Data Sourced
via OSV·08:52 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An attacker needs to be an authenticated API user. The issue affects titra versions 1.0.3 and earlier.
2
What access or impact can exploitation provide?
A qualifying API user can use the customfields object in the timeentry/create or project/task/create endpoints to inject or overwrite top-level fields in MongoDB documents. The reported impact is limited to integrity of the vulnerable component.
3
Is a patch available?
No publicly known patches were available at the time of publication.