{"id":"CVE-2026-42279","aliases":["EUVD-2026-28527","GHSA-pmf9-pxq9-ccwr"],"status":"published","title":"solidtime: Time entry update endpoint allows cross-organization modification of a known time-entry UUID","description":"solidtime is an open-source time-tracking app. In version 0.12.0, the PUT /api/v1/organizations/{organization}/time-entries/{timeEntry} API accepts a route-bound timeEntry from another organization when the caller has time-entries:update:all in the URL organization, allowing a known foreign time-entry UUID to be modified and rebound to objects in the caller's organization. This issue has been patched in version 0.12.1.","severity":{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00266,"percentile":0.18886,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-639"],"published":"2026-05-08T03:57:31Z","modified":"2026-10-28T02:30:32Z","products":[{"vendor":"solidtime","product":"solidtime"},{"vendor":"solidtime-io","product":"solidtime"}],"references":[{"url":"https://github.com/solidtime-io/solidtime/security/advisories/GHSA-pmf9-pxq9-ccwr","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory","advisory"]},{"url":"https://github.com/solidtime-io/solidtime/commit/b73aa543fdf5b61c37447307ab7277451296832c","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://github.com/solidtime-io/solidtime/releases/tag/v0.12.1","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42279.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42279","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-42279","title":"solidtime: Time entry update endpoint allows cross-organization modification of a known time-entry UUID","description":"solidtime is an open-source time-tracking app. In version 0.12.0, the PUT /api/v1/organizations/{organization}/time-entries/{timeEntry} API accepts a route-bound timeEntry from another organization when the caller has time-entries:update:all in the URL organization, allowing a known foreign time-entry UUID to be modified and rebound to objects in the caller's organization. This issue has been patched in version 0.12.1.","status":"published","published":"2026-05-08T03:57:31.727Z","modified":"2026-05-08T10:38:51.086Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T13:40:23.731501Z"}],"euvd":[{"id":"EUVD-2026-28527","description":"solidtime is an open-source time-tracking app. In version 0.12.0, the PUT /api/v1/organizations/{organization}/time-entries/{timeEntry} API accepts a route-bound timeEntry from another organization when the caller has time-entries:update:all in the URL organization, allowing a known foreign time-entry UUID to be modified and rebound to objects in the caller's organization. This issue has been patched in version 0.12.1.","status":"published","published":"2026-05-08T03:57:31Z","modified":"2026-05-08T10:38:51Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T19:05:14.902845Z"}],"nvd":[{"id":"CVE-2026-42279","description":"solidtime is an open-source time-tracking app. In version 0.12.0, the PUT /api/v1/organizations/{organization}/time-entries/{timeEntry} API accepts a route-bound timeEntry from another organization when the caller has time-entries:update:all in the URL organization, allowing a known foreign time-entry UUID to be modified and rebound to objects in the caller's organization. This issue has been patched in version 0.12.1.","status":"published","published":"2026-05-08T05:16:11.063Z","modified":"2026-06-17T10:47:37.423Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:12:17.842772Z"}],"osv":[{"id":"CVE-2026-42279","title":"solidtime: Time entry update endpoint allows cross-organization modification of a known time-entry UUID","description":"solidtime is an open-source time-tracking app. In version 0.12.0, the PUT /api/v1/organizations/{organization}/time-entries/{timeEntry} API accepts a route-bound timeEntry from another organization when the caller has time-entries:update:all in the URL organization, allowing a known foreign time-entry UUID to be modified and rebound to objects in the caller's organization. This issue has been patched in version 0.12.1.","status":"published","published":"2026-05-08T03:57:31.727Z","modified":"2026-10-28T02:30:32.84265882Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T15:45:04.117819Z"}]}}