CVE-2026-42092: Titra Information Disclosure Vulnerability

CVE-2026-42092 Overview

titra is an open source time tracking application built on the Meteor framework. CVE-2026-42092 is an information disclosure vulnerability [CWE-200] in titra version 0.99.52. The globalsettings Meteor publication returns all global configuration without performing any administrative or role-based authorization check. Any authenticated user can subscribe to this publication via the Distributed Data Protocol (DDP) and retrieve sensitive configuration values, including google_secret, openai_apikey, and google_clientid. No public patch is available at the time of publication.

Critical Impact

Authenticated low-privilege users can extract OAuth client secrets and third-party API keys, enabling downstream account takeover and abuse of integrated Google and OpenAI services.

Affected Products

• titra time tracking application, version 0.99.52
• Meteor-based deployments using the globalsettings publication
• Self-hosted titra instances exposing DDP endpoints to authenticated users

Discovery Timeline

• 2026-05-04 - CVE-2026-42092 published to NVD
• 2026-05-04 - Last updated in NVD database

Technical Details for CVE-2026-42092

Vulnerability Analysis

The vulnerability resides in the server-side Meteor publication named globalsettings. Meteor publications stream documents from MongoDB collections to subscribed clients over DDP. Secure publications must validate the caller's identity and role before returning data. In titra 0.99.52, the globalsettings publication omits this gating logic entirely.

Any client holding a valid login token can call Meteor.subscribe('globalsettings') and receive the full settings document. The document contains integration credentials such as google_secret, google_clientid, and openai_apikey. These values are intended for server-side use only.

Exploitation does not require elevated privileges, social engineering, or unusual tooling. Standard Meteor client libraries or a generic DDP client are sufficient.

Root Cause

The root cause is a missing authorization check inside the publication handler. Meteor publications execute server-side code that should verify this.userId and the user's role before returning a cursor. The titra implementation returns the global settings cursor unconditionally, treating authentication as authorization.

Attack Vector

An attacker registers or compromises any standard titra account. After authenticating, the attacker opens a DDP connection and subscribes to the globalsettings publication. The server replies with the complete settings document, which the attacker reads from the local Minimongo cache or raw DDP messages.

Extracted OAuth client secrets enable the attacker to impersonate the titra application against Google identity services. Extracted OpenAI API keys permit unauthorized model usage billed to the victim organization. The exposure of google_clientid together with google_secret is sufficient to forge OAuth flows.

No verified proof-of-concept code is published. See the GitHub Security Advisory GHSA-4h9p-49hg-vppw for vendor-supplied technical details.

Detection Methods for CVE-2026-42092

Indicators of Compromise

• DDP subscription messages naming globalsettings originating from non-administrative user sessions.
• Outbound API calls to Google or OpenAI services using titra credentials from unexpected source addresses.
• Unusual OAuth token exchanges referencing the titra google_clientid outside normal application flows.

Detection Strategies

• Enable Meteor server logging at the DDP layer and alert on subscriptions to globalsettings from accounts not designated as administrators.
• Inspect MongoDB query logs for reads against the global settings collection initiated by user sessions rather than server jobs.
• Correlate authentication events with subsequent third-party API key usage to detect credential reuse from new locations.

Monitoring Recommendations

• Rotate google_secret, google_clientid, and openai_apikey and monitor for use of the previous values, which would indicate prior exfiltration.
• Enable provider-side anomaly alerts in Google Cloud Console and the OpenAI dashboard for spending spikes or new IP origins.
• Track titra account creation events alongside immediate DDP subscription activity, which is a behavioral signal of opportunistic exploitation.

How to Mitigate CVE-2026-42092

Immediate Actions Required

• Restrict network access to the titra DDP endpoint so that only trusted users can authenticate.
• Rotate all credentials stored in the global settings document, including Google OAuth secrets and OpenAI API keys.
• Audit user accounts and disable any accounts that should not have access to the titra deployment.
• Review provider-side logs for Google and OpenAI to identify unauthorized use of leaked credentials.

Patch Information

No public patch is available at the time of publication. Monitor the titra GitHub Security Advisory GHSA-4h9p-49hg-vppw for the official fix and apply it as soon as it is released. Administrators should subscribe to titra release notifications to receive updates promptly.

Workarounds

• Patch the globalsettings publication locally to verify this.userId and an administrator role before returning the cursor, returning this.ready() otherwise.
• Move sensitive credentials such as openai_apikey and google_secret out of the database settings document and into server-side environment variables that are never published.
• Limit titra registration to trusted users and disable self-service signup until a vendor patch is released.

# Example server-side mitigation: replace the unprotected publication
# in your titra fork before a vendor patch is available
Meteor.publish('globalsettings', function () {
  if (!this.userId) {
    return this.ready();
  }
  const user = Meteor.users.findOne(this.userId);
  if (!user || !user.isAdmin) {
    return this.ready();
  }
  return Globalsettings.find();
});