Dashboard / CVE-2026-42279

CVE-2026-42279

MEDIUM
MEDIUM Priority: 0.02 BB Relevance: 47/100
Published: 2026-05-08 Modified: 2026-11-11 First seen: 2026-11-11 Status: active

Attack Surface

Network No Interaction Integ. Impact Scope Change

CVSS Vector Breakdown

AV: Network
AC: High
PR: High
UI: None
S: Changed
C: None
I: High
A: None

Description

solidtime is an open-source time-tracking app. In version 0.12.0, the PUT /api/v1/organizations/{organization}/time-entries/{timeEntry} API accepts a route-bound timeEntry from another organization when the caller has time-entries:update:all in the URL organization, allowing a known foreign time-entry UUID to be modified and rebound to objects in the caller's organization. This issue has been patched in version 0.12.1.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
solidtime solidtime 0.12.0

References & Advisories (3)

Bug Bounty Relevance

47 / 100
✓ Network accessible
✓ No user interaction

CVSS Score

5.8 / 10.0 v3.1
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N

EPSS — Exploitation Probability

0.27%
Raw Score 0.002660
Percentile 18.9%
Date 2026-11-14

EPSS Trend

2026-11-14
0.00266
2026-11-13
0.00266
2026-11-12
0.00266
2026-11-10
0.00266

Intelligence Sources

nvd ref →

External Links