Titra API Contains Mass Assignment Vulnerability

Description

Titra is open source project time tracking software. In versions 0.99.49 and below, an API has a Mass Assignment vulnerability which allows authenticated users to inject arbitrary fields into time entries, bypassing business logic controls via the customfields parameter. The affected endpoint uses the JavaScript spread operator (...customfields) to merge user-controlled input directly into the database document. While customfields is validated as an Object type, there is no validation of which keys are permitted inside that object. This allows attackers to overwrite protected fields such as userId, hours, and state. The issue is fixed in version 0.99.50.

Scores

EPSS (exploitation in 30 days)

0.29% · top 78% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: poc · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.3.

Weakness

• CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes (opens in a new tab)All about CWE-915 and its CVEs

Affected products

• kromitgmbh · titra

  • affected < 0.99.50

References (2)

• https://github.com/kromitgmbh/titra/security/advisories/GHSA-gc65-vr47-jppq (opens in a new tab)x_refsource_CONFIRMexploit
• https://github.com/kromitgmbh/titra/commit/29e6b88eca005107729e45a6f1731cf0fa5f8938 (opens in a new tab)x_refsource_MISC

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-21695](https://trackcve.app/badge/CVE-2026-21695.svg)](https://trackcve.app/cve/CVE-2026-21695)

Record last updated 8 Jan 2026, 18:16 UTC.