CVE-2026-33345 - Vulnerability Analysis

Overview

solidtime < 0.11.6 contains a broken access control caused by missing authorization checks in the project detail endpoint, letting authenticated employees access any project including private ones, exploit requires authentication.

Severity & Score

Impact

Authenticated employees can access private projects they are not members of, leading to unauthorized data exposure.

Mitigation

Update to version 0.11.6 or later.

References

• https://github.com/solidtime-io/solidtime/commit/192c8c3b887aab34117b983c687934ca7c305209
• https://github.com/solidtime-io/solidtime/releases/tag/v0.11.6
• https://github.com/solidtime-io/solidtime/security/advisories/GHSA-354j-rx28-jjxm

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner