CVE-2026-42279 - Vulnerability Analysis

Overview

Solidtime 0.12.0 contains a broken access control vulnerability caused by improper validation of route-bound timeEntry in the PUT /api/v1/organizations/{organization}/time-entries/{timeEntry} API, letting attackers with time-entries:update:all permission modify time entries across organizations, exploit requires attacker to have time-entries:update:all permission.

Severity & Score

Impact

Attackers with update permission can modify time entries across organizations, leading to unauthorized data modification.

Mitigation

Upgrade to version 0.12.1.

References

• https://github.com/solidtime-io/solidtime/commit/b73aa543fdf5b61c37447307ab7277451296832c
• https://github.com/solidtime-io/solidtime/releases/tag/v0.12.1
• https://github.com/solidtime-io/solidtime/security/advisories/GHSA-pmf9-pxq9-ccwr

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner