TI-2026-17477 Aliases CVE-2026-21694

Titra APIs have Improper Access Control

HIGH 70CWE-284Published 2026-01-07 · Updated 2026-01-08

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-284.

Summary

Titra is open source project time tracking software. Versions 0.99.49 and below have Improper Access Control, allowing users to view and edit other users' time entries in private projects they have not been granted access to. This issue is fixed in version 0.99.50.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00284 21st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed titra (kromitgmbh): 0.99.50

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
kromitgmbh	titra	before 0.99.50	0.99.50	Patch available	CNA

titra Vendorkromitgmbh Affected before 0.99.50 Fixed in 0.99.50 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:kromit:titra::::::::	before 0.99.50	Vulnerable	kromitgmbh

cpe:2.3:a:kromit:titra:*:*:*:*:*:*:*:* Versions before 0.99.50 Vulnerable ·kromitgmbh

Remediation

Fix · CNA titra (kromitgmbh) Fixed in 0.99.50

Timeline

2026-10-02 Threatist record created from CVE-2026-21694

References

Exploit 1

https://github.com/kromitgmbh/titra/security/advisories/GHSA-mr2r-wjf8-cj3c

Patch 1

https://github.com/kromitgmbh/titra/commit/29e6b88eca005107729e45a6f1731cf0fa5f8938

TI-2025-42733 Titra has Remote Code Execution in Admin Functionality CVSS 3.1CRITICAL 9.1
TI-2026-17478 Titra API Contains Mass Assignment Vulnerability CVSS 3.1MEDIUM 4.3
TI-2022-02397 Improper Authorization in kromitgmbh/titra CVSS 3.1CRITICAL 10.0
TI-2022-01941 Weak Password Requirements in kromitgmbh/titra CVSS 3.1CRITICAL 9.8
TI-2022-01879 Improper Neutralization of Formula Elements in a CSV File in kromitgmbh/titra CVSS 3.1HIGH 8.0
TI-2022-01881 Cross-site Scripting (XSS) - DOM in kromitgmbh/titra CVSS 3.1MEDIUM 5.4

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences