Access Control Flaw in Solidtime Time-Tracking App

CVE-2026-33345

What is CVE-2026-33345?

Solidtime, an open-source time-tracking application, has a critical access control vulnerability that allows authenticated Employees to access any project within an organization via the project detail endpoint. This includes the potential to view private projects they are not authorized to access by simply knowing the UUID. The vulnerability arises because the endpoint does not properly apply the visibility restrictions that are correctly enforced by other parts of the application. This issue has been addressed in version 0.11.6, which users are strongly advised to upgrade to in order to enhance their security.

References