Nixpkgs security tracker

Untriaged

Permalink CVE-2026-33345

6.5 MEDIUM

CVSS version: 3.1
Attack vector (AV): NETWORK
Attack complexity (AC): LOW
Privileges required (PR): LOW
User interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality impact (C): HIGH
Integrity impact (I): NONE
Availability impact (A): NONE

created 3 weeks, 4 days ago

solidtime vulnerable to IDOR in private projects

solidtime is an open-source time-tracking app. Prior to version 0.11.6, the project detail endpoint GET /api/v1/organizations/{org}/projects/{project} allows any authenticated Employee to access any project in the organization by UUID, including private projects they are not a member of. The index() endpoint correctly applies the visibleByEmployee() scope, but show() does not. This issue has been patched in version 0.11.6.

References

https://github.com/solidtime-io/solidtime/security/advisories/GHSA-354j-rx28-jjxm x_refsource_CONFIRM
https://github.com/solidtime-io/solidtime/commit/192c8c3b887aab34117b983c687934ca7c305209 x_refsource_MISC
https://github.com/solidtime-io/solidtime/releases/tag/v0.11.6 x_refsource_MISC

Affected products

solidtime

==< 0.11.6

Matching in nixpkgs

pkgs.solidtime-desktop

Modern open-source time-tracking app

nixos-unstable 0.0.42
- nixpkgs-unstable 0.0.42
- nixos-unstable-small 0.0.42
nixos-25.11 0.0.42
- nixos-25.11-small 0.0.42
- nixpkgs-25.11-darwin 0.0.42

Package maintainers

@hensoko hensoko <hensoko@pub.solar>

Suggestion detail

References

Affected products

Matching in nixpkgs

pkgs.solidtime-desktop

Package maintainers