Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
titra is an open source time tracking project. In version 0.99.52, the globalsettings Meteor publication returns all global settings without any admin or role check. Any authenticated user can subscribe via DDP and receive sensitive configuration fields such as google_secret, openai_apikey, and google_clientid. At time of publication no public patch is available.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-42092 Unauthenticated Information Disclosure in Titra 0.99.52 Global Settings https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42092
Post summary
The text announces CVE‑2026‑42092, noting an unauthenticated information disclosure in Titra 0.99.52, but provides no PoC, exploit, patch, or active exploitation details.
CVE-2026-42092 titra is an open source time tracking project. In version 0.99.52, the globalsettings Meteor publication returns all global settings without any admin or role check. … https://www.cve.org/CVERecord?id=CVE-2026-42092
Post summary
The post discloses CVE-2026-42092 in the open‑source Titra project, detailing that the globalsettings publication exposes all settings without authorization checks, but no PoC, exploit, or mitigation is provided.