In Titra version 0.99.52 the globalsettings Meteor publication returns all configuration data without performing any admin or role verification. Any authenticated user can subscribe via DDP and receive sensitive configuration fields such as google_secret, openai_apikey, and google_clientid. This flaw allows an attacker with regular user credentials to obtain confidential credentials and other configuration information, creating a potential confidentiality breach.

The affected product is the open‑source Titra time‑tracking application, specifically release 0.99.52.

The CVSS score of 6.5 indicates a medium severity vulnerability. The EPSS score is not available, so the likelihood of exploitation is uncertain, yet the impact is significant because any authenticated user can download the data. The vulnerability is not currently listed in the CISA KEV catalog, but the lack of an access check means that once an attacker obtains an account, the exploitation path is trivial and does not require additional prerequisites.