What is the CVSS score of CVE-2026-42092?

CVE-2026-42092 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

titra CVE-2026-42092

EUVD-2026-27069 MEDIUM

Information Exposure (CWE-200)

2026-05-04 GitHub_M

Information Disclosure Titra

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 04, 2026 - 18:03 vuln.today

Analysis Generated

May 04, 2026 - 17:45 vuln.today

CVE Published

May 04, 2026 - 17:30 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

titra is an open source time tracking project. In version 0.99.52, the globalsettings Meteor publication returns all global settings without any admin or role check. Any authenticated user can subscribe via DDP and receive sensitive configuration fields such as google_secret, openai_apikey, and google_clientid. At time of publication no public patch is available.

AnalysisAI

titra 0.99.52 leaks sensitive global configuration settings to any authenticated user via an unprotected Meteor DDP publication, exposing API keys and OAuth secrets without administrative checks. Authenticated attackers can subscribe to the globalsettings publication and retrieve plaintext credentials including google_secret, openai_apikey, and google_clientid. No public patch is available at time of publication.

Technical ContextAI

titra is a time-tracking application built on the Meteor framework, which uses DDP (Distributed Data Protocol) for real-time data synchronization between client and server. Meteor publications are server-side functions that define what data clients can subscribe to; they should enforce authorization checks to prevent unauthorized data access. The globalsettings publication fails to implement role-based or admin-level access controls, returning all sensitive configuration parameters to unauthenticated DDP subscribers. The vulnerability is rooted in CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), specifically the failure to implement proper authorization boundaries in a data-sharing mechanism that handles secrets and API keys.

RemediationAI

No vendor-released patch is available at time of publication. Immediate workarounds include: (1) Implement authorization checks in the globalsettings Meteor publication to restrict access to admin-role users only, by adding a role verification conditional before data return; (2) Move sensitive configuration (API keys, secrets) from MongoDB global settings to environment variables or secure vaults not exposed via DDP publications, removing them from the globalsettings collection entirely; (3) Restrict DDP access at the network level by disabling Meteor accounts for non-administrative users if the application supports role-based user tiers, or require authentication tokens with expiration before DDP subscription; (4) Rotate all exposed credentials (Google OAuth, OpenAI API keys) immediately and regenerate client IDs to revoke any leaked material. Monitor GitHub security advisory GHSA-4h9p-49hg-vppw and the titra repository (https://github.com/titraio/titra) for patched releases. Trade-off: moving secrets to environment variables requires deployment changes but provides the strongest isolation.