What’s Vulnerable › Vulnerabilities

CVE-2026-33345: solidtime vulnerable to IDOR in private projects

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-03-24 · updated 2026-06-17
• Weakness: CWE-639

Description

solidtime is an open-source time-tracking app. Prior to version 0.11.6, the project detail endpoint GET /api/v1/organizations/{org}/projects/{project} allows any authenticated Employee to access any project in the organization by UUID, including private projects they are not a member of. The index() endpoint correctly applies the visibleByEmployee() scope, but show() does not. This issue has been patched in version 0.11.6.

Affected products

• solidtime-io solidtime: before 0.11.6 — fixed in 0.11.6

How to fix

Upgrade to a fixed version: solidtime-io solidtime 0.11.6. Check the vendor advisory for mitigations.

References

• https://github.com/solidtime-io/solidtime/commit/192c8c3b887aab34117b983c687934ca7c305209
• https://github.com/solidtime-io/solidtime/releases/tag/v0.11.6
• https://github.com/solidtime-io/solidtime/security/advisories/GHSA-354j-rx28-jjxm

Get alerted when CVE-2026-33345 or the next vulnerability affects your stack