Unrated severityNVD Advisory· Published Nov 9, 2026
titra: residual mass assignment via customfields in timeentry/create and project/task/create
CVE-2026-63497
Description
titra is an open source time tracking project. In versions 1.0.3 and prior, authenticated API users can abuse the customfields object to inject or overwrite top-level fields in MongoDB documents. At time of publication, there are no publicly known patches.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
1- github.com/titraio/titra/security/advisories/GHSA-cphv-qx83-x397mitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.