The vulnerability lies in the PUT /api/v1/organizations/{organization}/time-entries/{timeEntry} endpoint, which accepts a timeEntry identifier that origin belongs to another organization when the caller possesses the time-entries:update:all scope for the target organization. This enables an authenticated user to modify a known foreign time‑entry and rebind it to an object in their own organization. The result is the ability to alter billing, reporting, and time‑tracking data with the privileges of another entity, representing a serious integrity risk.

The affected product is solidtime‑io’s open‑source time‑tracking application. Version 0.12.0 is vulnerable, and the issue is fixed in version 0.12.1. Users running 0.12.0 or earlier are susceptible to this flaw.

With a CVSS score of 5.8 this vulnerability is considered moderate severity. No EPSS score is available, and it is not listed in CISA’s KEV catalog. The attack vector is authenticated, requiring a user with the time-entries:update:all permission in the target organization. The attacker must know a valid foreign time‑entry UUID, which may be discovered through normal API usage or enumeration. Once these conditions are satisfied, the attacker can alter cross‑organization records without authorization.