CVE-2026-42279 MEDIUM

CVE-2026-42279: solidtime: Time entry update endpoint allows cross-organization modification of a known time-entry UUID

Vendor Solidtime-Io
Product solidtime
Weakness CWE-639 · IDOR
Published May 8, 2026
Last update May 8, 2026
View on NVD All CVEs

CVSS base score

5.8/10
Attack vector Network
Attack complexity High
Privileges required High
User interaction None
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N

What the vulnerability does

01Description

solidtime is an open-source time-tracking app. In version 0.12.0, the PUT /api/v1/organizations/{organization}/time-entries/{timeEntry} API accepts a route-bound timeEntry from another organization when the caller has time-entries:update:all in the URL organization, allowing a known foreign time-entry UUID to be modified and rebound to objects in the caller's organization. This issue has been patched in version 0.12.1.

Key dates

02Disclosure timeline

May 8, 2026 CVE published
May 8, 2026 Record updated