https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-13T05:17:32.912637+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-42279 CVE-2026-42279 — solidtime: Time entry update endpoint allows cross-organization modification of a known time-entry UUID 2026-10-13T05:17:32.913706+00:00

Affected: solidtime-io solidtime

solidtime is an open-source time-tracking app. In version 0.12.0, the PUT /api/v1/organizations/{organization}/time-entries/{timeEntry} API accepts a route-bound timeEntry from another organization when the caller has time-entries:update:all in the URL organization, allowing a known foreign time-entry UUID to be modified and rebound to objects in the caller's organization. This issue has been patched in version 0.12.1.