Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
solidtime is an open-source time-tracking app. In version 0.12.0, the PUT /api/v1/organizations/{organization}/time-entries/{timeEntry} API accepts a route-bound timeEntry from another organization when the caller has time-entries:update:all in the URL organization, allowing a known foreign time-entry UUID to be modified and rebound to objects in the caller's organization. This issue has been patched in version 0.12.1.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CVE-2026-42279 solidtime is an open-source time-tracking app. In version 0.12.0, the PUT /api/v1/organizations/{organization}/time-entries/{timeEntry} API accepts a route-bound time… https://www.cve.org/CVERecord?id=CVE-2026-42279
Post summary
The entry reports CVE‑2026‑42279 in Solidtime, noting an API endpoint that improperly accepts a route‑bound time; it lacks evidence of PoC, exploitation, or remediation details.
CVE-2026-42279 Unauthorized Cross-Organization Time Entry Modification in Solidtime 0.12.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42279
Post summary
CVE-2026-42279 discloses a vulnerability that allows unauthorized modification of time entries across organizations in Solidtime 0.12.0.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | solidtime | solidtime | 0.12.0 | - | - |