A mass assignment flaw allows authenticated API users to inject or overwrite top‑level fields in MongoDB documents by manipulating a customfields object. The vulnerability is a classic data tampering issue (CWE‑74) that can alter time‑entry or task records, potentially affecting project accounting, reporting, and audit trails. Because the change is made at the database level, it bypasses normal business‑rules checks and can overwrite critical attributes. The problem is not a denial of service or code execution, but it threatens the integrity of stored data and the trustworthiness of the system output.

The open‑source time‑tracking application Titra, version 1.0.3 and earlier, is affected. Users of the public API can trigger the flaw; there is no current patch, so any deployment of these versions remains vulnerable until an update is released.

The CVSS score is 5.3, indicating moderate severity. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, implying limited public exploitation yet. Attack requires a valid authenticated API token, so insiders or compromised credentials could exploit the flaw. No known public exploits exist, so the main risk lies in internal misuse or accidental configuration changes.