{"data":{"id":"7ebdc50b-df34-4b8f-ac3c-a870bbaf990d","title":"CVE-2026-42092: titra is an open source time tracking project. In version 0.99.52, the globalsettings Meteor publication returns all…","summary":"CVE-2026-42092 affects titra, an open source time tracking project, in version 0.99.52. The globalsettings Meteor publication returns all global settings without any admin or role check, so any authenticated user can subscribe via DDP and receive sensitive fields such as google_secret, openai_apikey, and google_clientid. The weakness is classified as CWE-200, Exposure of Sensitive Information to an Unauthorized Actor.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42092","publishedAt":"2026-05-04T18:16:31.363Z","cveId":"CVE-2026-42092","cweIds":["CWE-200"],"cvssScore":"6.5","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["titra","OpenAI","Google"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"titra exposes global settings through globalsettings Meteor publication","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00219,"epssCheckedAt":"2026-11-09T18:09:52.424Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-03T06:12:13.883Z","patchAvailable":null,"disclosureDate":"2026-05-04T18:16:31.363Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-116"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":null,"fixes":[]}}