What is the CVSS score of CVE-2026-33345?

CVE-2026-33345 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Solidtime are affected by CVE-2026-33345?

Organizations using solidtime should be aware of notable risk from CVE-2026-33345, a IDOR vulnerability rated CVSS 6.5. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-33345?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Solidtime CVE-2026-33345

EUVD-2026-14996 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-03-24 GitHub_M

Authentication Bypass Solidtime

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

0.11.6

EUVD ID Assigned

Mar 24, 2026 - 19:46 euvd

EUVD-2026-14996

Analysis Generated

Mar 24, 2026 - 19:46 vuln.today

CVE Published

Mar 24, 2026 - 19:30 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

solidtime is an open-source time-tracking app. Prior to version 0.11.6, the project detail endpoint GET /api/v1/organizations/{org}/projects/{project} allows any authenticated Employee to access any project in the organization by UUID, including private projects they are not a member of. The index() endpoint correctly applies the visibleByEmployee() scope, but show() does not. This issue has been patched in version 0.11.6.

AnalysisAI

Solidtime prior to version 0.11.6 contains an authorization bypass vulnerability in its project detail endpoint that allows any authenticated employee to access private projects they are not members of by directly querying the GET /api/v1/organizations/{org}/projects/{project} endpoint with a project UUID. The vulnerability stems from inconsistent authorization scope application between the index() and show() methods, enabling confidentiality breach of sensitive project data. A security patch is available in version 0.11.6 and the vulnerability has been disclosed via GitHub Security Advisory GHSA-354j-rx28-jjxm.

Technical ContextAI

Solidtime (CPE: cpe:2.3:a:solidtime-io:solidtime:*:*:*:*:*:*:*:*) is an open-source time-tracking application built with a REST API architecture. The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), which occurs when authorization decisions depend on user-controlled input without proper validation. Specifically, the show() method retrieves project details by UUID without applying the visibleByEmployee() scope that correctly restricts access in the index() method. This represents a broken access control vulnerability at the API endpoint layer where resource-level authorization checks are missing, allowing authenticated users to enumerate and access organizational resources beyond their intended scope.

RemediationAI

Upgrade Solidtime immediately to version 0.11.6 or later, which includes the authorization scope fix applied in commit 192c8c3b887aab34117b983c687934ca7c305209 (available at https://github.com/solidtime-io/solidtime/commit/192c8c3b887aab34117b983c687934ca7c305209). This patch ensures that the show() endpoint properly applies the visibleByEmployee() scope filter to restrict project access to authorized employees only. As an interim mitigation before patching, implement network-level access controls to restrict the /api/v1/organizations/*/projects/* endpoint to trusted networks, enforce strong authentication practices, and audit API logs for suspicious project enumeration patterns (repeated requests with different project UUIDs). After upgrading, verify that authorization scopes are consistently applied across all API endpoints through integration testing.