solidtime CVE-2026-42279

solidtime is a Laravel-based time-tracking application using route model binding to resolve URL parameters. The vulnerability stems from the API controller's permission checks failing to validate that the route-bound timeEntry object belongs to the same organization specified in the URL path. Route model binding in Laravel automatically resolves the {timeEntry} parameter to a TimeEntry model by UUID without implicit multi-tenant scope enforcement. The checkPermission() calls previously validated only the organization and permission level (time-entries:update:own or time-entries:update:all) but did not verify that the resolved timeEntry entity's organization_id matched the {organization} parameter. CWE-639 (Authorization Bypass Through User-Controlled Key) applies because the attacker controls the timeEntry UUID in the URL and can bypass the intended multi-tenant authorization boundary by selecting a UUID from a different organization. The fix adds the timeEntry object as a third parameter to checkPermission(), enabling organization membership validation at the time-entry level.