The vulnerability is an improper access control flaw that allows authenticated users to view and edit time entries belonging to other users in private projects. This leads to confidentiality leakage and integrity compromise, enabling the attacker to read or modify sensitive work logs.

The flaw affects the open‑source Titra time‑tracking application from kromitgmbh. All releases up to and including 0.99.49 are vulnerable; the issue is resolved in 0.99.50.

The CVSS score of 6.8 indicates moderate severity, and the EPSS score of less than 1% suggests a low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by accessing the exposed API endpoints while authenticated, implying a remote attack vector that requires legitimate credentials but does not involve code execution.