CVE-2026-42279: Solidtime Auth Bypass Vulnerability

CVE-2026-42279 Overview

CVE-2026-42279 is a broken access control vulnerability in solidtime, an open-source time-tracking application. The flaw affects version 0.12.0 of the application. The PUT /api/v1/organizations/{organization}/time-entries/{timeEntry} endpoint fails to verify that a route-bound timeEntry belongs to the organization in the URL. An authenticated user with time-entries:update:all permission in their own organization can modify time entries belonging to other organizations. The attacker must know the foreign time-entry UUID to abuse this issue. The vulnerability is classified under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Authenticated users with elevated permissions in one organization can modify time-entry records in unrelated tenants and rebind them to objects under their control, breaking multi-tenant isolation.

Affected Products

solidtime 0.12.0
Earlier releases that share the unpatched TimeEntryController logic
Self-hosted deployments using the affected container or source build

Discovery Timeline

2026-05-08 - CVE-2026-42279 published to NVD
2026-05-08 - Last updated in NVD database
Patch released - solidtime version 0.12.1 published on GitHub via commit b73aa543fdf5b61c37447307ab7277451296832c

Technical Details for CVE-2026-42279

Vulnerability Analysis

The vulnerability resides in app/Http/Controllers/Api/V1/TimeEntryController.php. The update handler enforces a permission check against the URL-supplied organization but does not validate that the route-bound $timeEntry model belongs to that organization. Laravel route model binding resolves the timeEntry UUID directly from the database without scoping it to the parent organization. As a result, any caller holding time-entries:update:all in their own organization can target a UUID owned by a different tenant. Once accepted, the update payload can rebind the foreign time entry to members, projects, or tasks inside the caller's organization, contaminating tenant data.

Root Cause

The checkPermission() invocation received only the organization context, never the target $timeEntry instance. The authorization layer therefore had no opportunity to compare $timeEntry->organization_id against the route organization. This is a textbook insecure direct object reference where the object identifier is trusted without an ownership check.

Attack Vector

An authenticated user must possess time-entries:update:all in any organization and must learn the UUID of a time entry in a different organization. The attacker issues a PUT request to their own organization endpoint while supplying the foreign timeEntry UUID in the path. The server resolves the foreign record, passes the original permission gate, and applies the requested mutation. The exploitable scope crosses tenant boundaries, which raises the impact despite the high privilege requirement.

php

        /** @var Member|null $member */
        $member = $request->has('member_id') ? Member::query()->findOrFail($request->input('member_id')) : null;
        if ($timeEntry->member->user_id === Auth::id() && ($member === null || $member->user_id === Auth::id())) {
-            $this->checkPermission($organization, 'time-entries:update:own');
+            $this->checkPermission($organization, 'time-entries:update:own', $timeEntry);
        } else {
-            $this->checkPermission($organization, 'time-entries:update:all');
+            $this->checkPermission($organization, 'time-entries:update:all', $timeEntry);
        }

        if ($timeEntry->end !== null && $request->has('end') && $request->input('end') === null) {

Source: solidtime patch commit b73aa543

The patch forwards the resolved $timeEntry into checkPermission() so the authorization layer can validate organization ownership of the target record.

Detection Methods for CVE-2026-42279

Indicators of Compromise

PUT requests to /api/v1/organizations/{organization}/time-entries/{timeEntry} where the resolved timeEntry.organization_id does not match the URL organization value.
Time-entry audit records whose member_id, project_id, or task_id were rebound to objects in a different organization than the entry's original tenant.
Spikes in 200-OK responses on the time-entry update endpoint from accounts that historically only modified their own entries.

Detection Strategies

Add server-side logging that records both the URL organization and the loaded timeEntry.organization_id on every update call, then alert when they diverge.
Replay authentication and authorization logs against the API gateway to identify users invoking time-entries:update:all against unfamiliar UUIDs.
Run periodic database integrity queries to surface time entries whose member.organization_id differs from time_entry.organization_id.

Monitoring Recommendations

Forward solidtime web server and application logs into a centralized analytics platform for cross-tenant query support.
Track 4xx and 5xx anomalies after upgrading to 0.12.1 to confirm the new authorization check is rejecting prior attack patterns.
Alert on any administrative API key usage outside business hours, particularly for tokens with time-entries:update:all.

How to Mitigate CVE-2026-42279

Immediate Actions Required

Upgrade solidtime to version 0.12.1, which contains the authorization fix in commit b73aa543fdf5b61c37447307ab7277451296832c.
Audit existing role assignments and revoke time-entries:update:all from accounts that do not require organization-wide write access.
Review time-entry records created or modified on 0.12.0 for cross-organization rebinding and restore from backup where tampering is found.

Patch Information

The maintainers released the fix in solidtime v0.12.1. Technical details are documented in the GitHub Security Advisory GHSA-pmf9-pxq9-ccwr. The patch passes the target $timeEntry into checkPermission() so the policy can enforce ownership against the URL organization.

Workarounds

Restrict the time-entries:update:all permission to a minimal set of trusted administrators until 0.12.1 is deployed.
Place a reverse-proxy rule that inspects the PUT payload and rejects requests when the JSON body references identifiers outside the URL organization.
Disable public API token issuance for non-administrative accounts on the affected instance.

bash

# Upgrade solidtime to the patched release
git fetch --tags
git checkout v0.12.1
composer install --no-dev --optimize-autoloader
php artisan migrate --force
php artisan config:cache