{"identifier":"CVE-2026-42092","cve":{"id":"CVE-2026-42092","description":"titra is an open source time tracking project. In version 0.99.52, the globalsettings Meteor publication returns all global settings without any admin or role check. Any authenticated user can subscribe via DDP and receive sensitive configuration fields such as google_secret, openai_apikey, and google_clientid. At time of publication no public patch is available.","published":"2026-05-04T18:16:31.363000+00:00","modified":"2026-10-26T19:10:00.163000+00:00","status":"Deferred","score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_version":"3.1","affected":[],"weaknesses":["CWE-200"],"references":[{"url":"https://github.com/titraio/titra/security/advisories/GHSA-4h9p-49hg-vppw","source":"security-advisories@github.com"}],"kev":null,"kev_checked":true,"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-05-06T13:42:21.591120Z","id":"CVE-2026-42092","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[],"source":"nvd","retrieved_at":"2026-10-28T10:19:58.276684+00:00","exploited":false,"kev_stale":false,"products":[],"priority":{"label":"Assess exposure and vendor guidance","reasons":["No higher-priority signal is available in the current stored evidence."]},"epss":{"probability":0.00219,"percentile":0.12387,"date":"2026-10-29","stale":false},"version_assessment":null},"news":[],"campaigns":[],"domains":[{"domain":"github.com","source_url":"https://github.com/titraio/titra/security/advisories/GHSA-4h9p-49hg-vppw","investigate_url":"https://investigate.aeglixmind.com/#github.com"}],"arsenal_url":"https://arsenal.aeglixmind.com/?cve=CVE-2026-42092","catalog_url":"https://cves.aeglixmind.com/cve/CVE-2026-42092","research_url":"https://investigate.aeglixmind.com/research/cve/CVE-2026-42092","coverage":{"news_candidates_checked":0,"campaign_candidates_checked":0,"bounded":false,"notice":"Exact CVE mentions in stored public excerpts and reviewed campaign content only. A mention is not proof of exploitation, attribution or tool suitability. Missing matches do not establish absence."}}