CVE-2026-33345

solidtime is an open-source time-tracking app. Prior to version 0.11.6, the project detail endpoint GET /api/v1/organizations/{org}/projects/{project} allows any authenticated Employee to access any project in the organization by UUID, including private projects they are not a member of. The index() endpoint correctly applies the visibleByEmployee() scope, but show() does not. This issue has been patched in version 0.11.6.

• CWE-639

• https://github.com/solidtime-io/solidtime/commit/192c8c3b887aab34117b983c687934ca7c305209Patch
• https://github.com/solidtime-io/solidtime/releases/tag/v0.11.6Product, Release Notes
• https://github.com/solidtime-io/solidtime/security/advisories/GHSA-354j-rx28-jjxmExploit, Mitigation, Vendor Advisory

Published

Mar 24, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33336Vikunja is an open-source self-hosted task management platfo…8.8
• CVE-2026-33337Firebird is an open-source relational database management sy…7.5
• CVE-2026-3334The CMS Commander plugin for WordPress is vulnerable to SQL …8.8
• CVE-2026-33340LoLLMs WEBUI provides the Web user interface for Lord of Lar…9.1
• CVE-2026-33343etcd is a distributed key-value store for the data of a dist…6.5
• CVE-2026-33344Dagu is a workflow engine with a built-in Web user interface…8.1
• CVE-2026-33346OpenEMR is a free and open source electronic health records …8.7
• CVE-2026-33347league/commonmark is a PHP Markdown parser. From version 2.3…6.1
• CVE-2026-33348OpenEMR is a free and open source electronic health records …5.4
• CVE-2026-33349fast-xml-parser allows users to process XML from JS object w…5.9
• CVE-2026-3335The Canto plugin for WordPress is vulnerable to Missing Auth…5.3
• CVE-2026-33350LORIS (Longitudinal Online Research and Imaging System) is a…7.5