{"id":"CVE-2026-42092","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-42092","generatedAt":"2026-10-28T03:38:50.924Z","title":"titra is an open source time tracking project.","description":"titra is an open source time tracking project. In version 0.99.52, the globalsettings Meteor publication returns all global settings without any admin or role check. Any authenticated user can subscribe via DDP and receive sensitive configuration fields such as google_secret, openai_apikey, and google_clientid. At time of publication no public patch is available.","published":"2026-05-04T18:16:31.000Z","lastModified":"2026-10-26T19:10:00.000Z","status":"Deferred","sourceIdentifier":"security-advisories@github.com","cvss":{"version":"3.1","score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},"cwe":["CWE-200"],"affected":[],"epss":{"score":0.00219,"percentile":0.12285,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.22%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://github.com/titraio/titra/security/advisories/GHSA-4h9p-49hg-vppw","source":"security-advisories@github.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-42092","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}