CVE-2026-63497
titra: residual mass assignment via customfields in timeentry/create and project/task/create
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
titra is an open source time tracking project. In versions 1.0.3 and prior, authenticated API users can abuse the customfields object to inject or overwrite top-level fields in MongoDB documents. At time of publication, there are no publicly known patches.
| CWE | CWE-74 |
| Vendor | titraio |
| Product | titra |
| Published | Nov 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for titraio titra
Be the first to know when new unknown vulnerabilities affecting titraio titra are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
titraio / titra
<= 1.0.3