API Injection Vulnerability in Titra Time Tracking Software by Titra
CVE-2026-63497

5.3MEDIUM

Key Information:

Vendor

Titraio

Status
Titra
Vendor
CVE Published:
9 November 2026

What is CVE-2026-63497?

The Titra time tracking project has a security flaw that allows authenticated API users to manipulate data in MongoDB. Versions up to 1.0.3 are particularly affected, enabling a scenario where malicious actors could inject or modify top-level fields within MongoDB documents through the customfields object. As of now, there are no publicly disclosed patches available to mitigate this issue, raising significant concerns for users relying on Titra for secure time tracking.

Affected Version(s)

titra <= 1.0.3

References

https://github.com/titraio/titra/security/advisories/GHSA...
x_refsource_CONFIRM

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.