CVE-2026-21695
📋 TL;DR
This CVE describes a Mass Assignment vulnerability in Titra time tracking software that allows authenticated users to inject arbitrary fields into time entries via the customfields parameter. Attackers can overwrite protected fields like userId, hours, and state, bypassing business logic controls. All users running Titra versions 0.99.49 and below are affected.
💻 Affected Systems
- Titra
📦 What is this software?
Titra by Kromit
⚠️ Risk & Real-World Impact
Worst Case
Attackers could manipulate time tracking data, falsify work hours, assign work to incorrect users, or potentially escalate privileges by modifying user-related fields.
Likely Case
Unauthorized modification of time entries leading to inaccurate billing, payroll errors, or project management data corruption.
If Mitigated
Limited to minor data integrity issues if proper input validation and field whitelisting are implemented.
🎯 Exploit Status
Exploitation requires authenticated access and knowledge of the vulnerable API endpoint structure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.99.50
Vendor Advisory: https://github.com/kromitgmbh/titra/security/advisories/GHSA-gc65-vr47-jppq
Restart Required: Yes
Instructions:
1. Update Titra to version 0.99.50 or later. 2. Restart the Titra application/service. 3. Verify the update was successful by checking the version.
🔧 Temporary Workarounds
Input Validation Middleware
allImplement server-side validation to restrict allowed fields in customfields parameter
API Endpoint Restriction
allTemporarily restrict or disable access to the vulnerable API endpoint
🧯 If You Can't Patch
- Implement strict input validation to only allow specific whitelisted fields in customfields parameter
- Add authentication and authorization checks to ensure users can only modify their own time entries
🔍 How to Verify
Check if Vulnerable:
Check if Titra version is 0.99.49 or below and if the API endpoint accepts customfields parameter with arbitrary keysCheck Version:
Check Titra application settings or package.json for version informationVerify Fix Applied:
Verify Titra version is 0.99.50 or later and test that customfields parameter no longer accepts protected field names📡 Detection & Monitoring
Log Indicators:
- Unusual API requests to time entry endpoints with customfields containing protected field names
- Multiple failed validation attempts on customfields parameter
Network Indicators:
- HTTP POST/PUT requests to time entry API with customfields parameter containing userId, hours, or state fields
SIEM Query:
source="titra" AND (customfields.userId OR customfields.hours OR customfields.state)