Titra versions 0.99.49 and earlier have a mass‑assignment flaw that allows an authenticated API user to insert arbitrary fields into time‑entry documents via the customfields parameter. The JavaScript spread operator directly merges the user‑supplied object into the database record without validating which keys are permitted. Attackers can therefore modify protected attributes such as userId, hours, and state, effectively hijacking time entries and potentially gaining unauthorized control over user accounts. This weakness corresponds to CWE‑915, “Arbitrary Update to Data Object.”

The issue affects Titra, an open‑source time‑tracking application developed by kromitgmbh, in all releases up to and including 0.99.49. The vulnerability is fixed in version 0.99.50 and later.

The CVSS score is 4.3, indicating a moderate severity vulnerability. The EPSS score is less than 1 %, suggesting a low likelihood of exploitation in the wild, and the flaw is not listed in the CISA KEV catalog. Exploitation requires a valid authenticated session with access to the affected API endpoint; an attacker would need to build a payload that injects disallowed fields into the customfields object. Once executed, the attacker could modify secured fields to affect account ownership, billing, or project time logs.