CVE-2026-42092
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
May 04, 2026
Vendor
unknown
Description
titra is an open source time tracking project. In version 0.99.52, the globalsettings Meteor publication returns all global settings without any admin or role check. Any authenticated user can subscribe via DDP and receive sensitive configuration fields such as google_secret, openai_apikey, and google_clientid. At time of publication no public patch is available.