Solidtime’s Jetstream web team page authorizes access only with a belongsToTeam() check and then serializes all pending invitation emails and member data into Inertia props. Because the page does not require the explicit invitations:view or members:view permissions, any employee who has been added to the organization can view email addresses of pending invitations and current members, even though the same user is forbidden from accessing them via the official API. This flaw exposes sensitive personal information, violating confidentiality, and represents a misuse of internal application functionality (CWE‑863).

The vulnerability affects the open‑source time‑tracking application Solidtime authored by solidtime‑io. All versions released before 0.12.2 are susceptible; the issue is patched in release 0.12.2 and later.

The CVSS score of 4.3 indicates moderate severity. The EPSS score of < 1% suggests a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalogue. Likely exploitation requires an internal attacker who is a member of the organization but lacks the specific view permissions; the attacker simply requests the team page from a web browser and receives the serialized data containing email addresses.