CVE-2026-33345: Solidtime Auth Bypass Vulnerability

CVE-2026-33345 Overview

solidtime is an open-source time-tracking application that contains an Insecure Direct Object Reference (IDOR) vulnerability in its project detail API endpoint. Prior to version 0.11.6, the GET /api/v1/organizations/{org}/projects/{project} endpoint allows any authenticated Employee to access any project in the organization by UUID, including private projects they are not a member of. This broken access control flaw enables unauthorized information disclosure of sensitive project data.

Critical Impact

Authenticated employees can bypass authorization controls to access confidential project information belonging to other teams or departments within the same organization, potentially exposing sensitive business data, client information, and proprietary work details.

Affected Products

• solidtime versions prior to 0.11.6
• solidtime API endpoint GET /api/v1/organizations/{org}/projects/{project}
• Self-hosted and cloud deployments of solidtime

Discovery Timeline

• 2026-03-24 - CVE CVE-2026-33345 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-33345

Vulnerability Analysis

This vulnerability stems from an inconsistent application of authorization scopes between two related API endpoints in the solidtime application. While the index() endpoint correctly applies the visibleByEmployee() scope to filter results based on user permissions, the show() endpoint does not implement equivalent access control checks. This discrepancy allows authenticated users to directly access project resources by UUID without verifying whether they have appropriate permissions to view those resources.

The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key), which occurs when the application uses a user-controllable key (in this case, the project UUID) to determine access to a resource without properly validating that the user has authorization to access that resource.

Root Cause

The root cause is a missing authorization check in the show() method of the project controller. When a request is made to retrieve project details, the application retrieves the project based on the provided UUID without verifying that the requesting user has the necessary permissions to view that project. The visibleByEmployee() scope that enforces proper access controls in the listing endpoint was not applied to the individual project retrieval endpoint.

Attack Vector

An attacker with valid employee credentials can exploit this vulnerability through network access to the API. The exploitation is straightforward: an authenticated employee simply needs to enumerate or guess valid project UUIDs, then directly request those projects via the vulnerable endpoint. Since no user interaction is required and the attack complexity is low, any authenticated user can potentially access all projects within their organization, regardless of their assigned project memberships or access levels.

The attack flow involves the authenticated user obtaining or guessing valid project UUIDs (which may be leaked through other endpoints or logs), then making direct API requests to GET /api/v1/organizations/{org}/projects/{project} with target project UUIDs to retrieve unauthorized project details.

Detection Methods for CVE-2026-33345

Indicators of Compromise

• Unusual access patterns where employees are querying projects they are not members of
• API audit logs showing requests to /api/v1/organizations/{org}/projects/{project} endpoints with project UUIDs outside the user's normal scope
• High volume of project detail requests from a single user account, potentially indicating enumeration attempts

Detection Strategies

• Implement API logging and monitoring to track access to the project detail endpoint, correlating requestor identity with project membership
• Deploy anomaly detection to identify employees accessing an unusually high number of distinct projects
• Review application logs for patterns of sequential UUID requests that may indicate enumeration attempts
• Configure web application firewall rules to alert on rapid successive requests to project endpoints

Monitoring Recommendations

• Enable verbose API audit logging for all project-related endpoints
• Set up alerts for access attempts to projects where the requesting user is not a member
• Monitor authentication logs for accounts making excessive API requests to sensitive endpoints
• Periodically audit access patterns to ensure users are only accessing resources within their authorized scope

How to Mitigate CVE-2026-33345

Immediate Actions Required

• Upgrade solidtime to version 0.11.6 or later immediately
• Review access logs for any suspicious project access patterns prior to patching
• Audit which projects may have been accessed by unauthorized users
• Consider temporarily restricting API access to critical projects until the patch is applied

Patch Information

The vulnerability has been addressed in solidtime version 0.11.6. The fix ensures that the show() endpoint now properly applies the visibleByEmployee() scope, consistent with the index() endpoint behavior. The specific commit addressing this issue can be found in the GitHub Commit Details. Users should upgrade to version 0.11.6 or later, which is available from the GitHub Release v0.11.6. For additional details, refer to the GitHub Security Advisory GHSA-354j-rx28-jjxm.

Workarounds

• If immediate patching is not possible, implement network-level access controls to restrict API access to trusted sources
• Deploy a reverse proxy or API gateway to add additional authorization checks before requests reach the solidtime application
• Review and restrict employee accounts to minimize the number of authenticated users who could potentially exploit this vulnerability
• Manually apply the authorization scope fix from commit 192c8c3b887aab34117b983c687934ca7c305209 if running a custom deployment

# Upgrade solidtime to patched version
cd /path/to/solidtime
git fetch origin
git checkout v0.11.6
composer install --no-dev
php artisan migrate
php artisan cache:clear