Read the docs
TI-2026-17478 Aliases CVE-2026-21695

Titra API Contains Mass Assignment Vulnerability

Priority MEDIUM 53CWE-915Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-915.

Summary

Titra is open source project time tracking software. In versions 0.99.49 and below, an API has a Mass Assignment vulnerability which allows authenticated users to inject arbitrary fields into time entries, bypassing business logic controls via the customfields parameter. The affected endpoint uses the JavaScript spread operator (...customfields) to merge user-controlled input directly into the database document. While customfields is validated as an Object type, there is no validation of which keys are permitted inside that object. This allows attackers to overwrite protected fields such as userId, hours, and state. The issue is fixed in version 0.99.50.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0029 21st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed titra (kromitgmbh): 0.99.50

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
kromitgmbhtitrabefore 0.99.500.99.50Patch availableCNA
  • titra Vendorkromitgmbh Affected before 0.99.50 Fixed in 0.99.50 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:kromit:titra:*:*:*:*:*:*:*:*before 0.99.50Vulnerablekromitgmbh
  • cpe:2.3:a:kromit:titra:*:*:*:*:*:*:*:* Versions before 0.99.50 Vulnerable ·kromitgmbh

Remediation

  • Fix · CNA titra (kromitgmbh) Fixed in 0.99.50

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-21695

References

Exploit 1

Patch 1

  • TI-2025-42733 Titra has Remote Code Execution in Admin Functionality CVSS 3.1CRITICAL 9.1
  • TI-2026-17477 Titra APIs have Improper Access Control CVSS 3.1HIGH 8.1
  • TI-2022-02397 Improper Authorization in kromitgmbh/titra CVSS 3.1CRITICAL 10.0
  • TI-2022-01941 Weak Password Requirements in kromitgmbh/titra CVSS 3.1CRITICAL 9.8
  • TI-2022-01879 Improper Neutralization of Formula Elements in a CSV File in kromitgmbh/titra CVSS 3.1HIGH 8.0
  • TI-2022-01881 Cross-site Scripting (XSS) - DOM in kromitgmbh/titra CVSS 3.1MEDIUM 5.4
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences