CVE-2026-21695— Titra API Contains Mass Assignment Vulnerability
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-21695
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Titra API Contains Mass Assignment Vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Titra is open source project time tracking software. In versions 0.99.49 and below, an API has a Mass Assignment vulnerability which allows authenticated users to inject arbitrary fields into time entries, bypassing business logic controls via the customfields parameter. The affected endpoint uses the JavaScript spread operator (...customfields) to merge user-controlled input directly into the database document. While customfields is validated as an Object type, there is no validation of which keys are permitted inside that object. This allows attackers to overwrite protected fields such as userId, hours, and state. The issue is fixed in version 0.99.50.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-915
Source: CVE Program / CVE List V5
Vulnerability Title
titra 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
titra是kromit开源的一款时间跟踪项目。 titra 0.99.49及之前版本存在安全漏洞，该漏洞源于API存在批量分配漏洞，允许经过身份验证的用户通过customfields参数注入任意字段，绕过业务逻辑控制。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| kromitgmbh | titra | < 0.99.50 | - |
II. Public POCs for CVE-2026-21695
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-21695
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-21695 (1)
Vendor Advisories for CVE-2026-21695 (1)
- https://github.com/kromitgmbh/titra/security/advisories/GHSA-gc65-vr47-jppqx_refsource_CONFIRM
IV. Related Vulnerabilities
Same vendor: kromitgmbh
- CVE-2026-21694
Titra APIs have Improper Access Control - CVE-2025-69288
Titra has Remote Code Execution in Admin Functionality - CVE-2022-2595
Improper Authorization in kromitgmbh/titra - CVE-2022-2098
Weak Password Requirements in kromitgmbh/titra - CVE-2022-2026
Cross-site Scripting (XSS) - Stored in kromitgmbh/titra
Same weakness: CWE-915
- CVE-2026-72655
Improperly Controlled Modification of Dynamically-Determined - CVE-2026-71473
Acm-search-v2-rhel9: search-v2-operator: addonfactory.getval - CVE-2026-17095
IBM i is Affected By Multiple Vulnerabilities in Navigator f - CVE-2026-72778
Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via cond - CVE-2026-18617
Data-science-pipelines-operator: dspo: mysql dsn parameter i
V. Comments for CVE-2026-21695
No comments yet