A flaw in the project detail endpoint allows any authenticated employee to retrieve information about projects they are not a member of, exposing private data. The vulnerability is an Insecure Direct Object Reference (IDOR) that can be used to read details of sensitive projects, potentially revealing confidential work information. The CWE classification for this weakness is 639, which indicates privilege escalation through inadequate access control.

The affected product is Solidtime by solidtime-io. All releases prior to version 0.11.6 are vulnerable, while version 0.11.6 and later contain a fix that enforces visibility checks for project resources.

The CVSS score of 6.5 indicates a moderate impact, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Attackers would need to be authenticated users of the system; they can exploit the issue simply by issuing a GET request to the vulnerable endpoint. Because the flaw permits disclosure of privileged project data, it poses a significant confidentiality risk to organizations using Solidtime.