CVE-2026-47236: Solidtime Information Disclosure Flaw

CVE-2026-47236 Overview

Solidtime is an open-source time-tracking application. CVE-2026-47236 is an authorization flaw that exposes pending invitation email addresses and organization member data to any authenticated employee of a Solidtime organization. The vulnerability affects all versions prior to 0.12.2.

While the official invitations and members API endpoints are gated by explicit invitations:view and members:view permissions, the Jetstream web team page authorizes access using only belongsToTeam(). The page then loads and serializes pending invitations and member records into Inertia props embedded in the rendered HTML, bypassing the permission model enforced at the API layer [CWE-863].

Critical Impact
Any authenticated organization member can read pending invitation email addresses and member details directly from the team page response, even when the API forbids the same user.

Affected Products

Solidtime versions prior to 0.12.2
Self-hosted and managed Solidtime deployments using the Jetstream team page
Solidtime organizations relying on invitations:view and members:view permission gating

Discovery Timeline

2026-06-12 - CVE-2026-47236 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-47236

Vulnerability Analysis

The flaw is an incorrect authorization issue in Solidtime's team management interface. Solidtime defines two explicit permissions, invitations:view and members:view, which gate access to the official REST API for organization invitations and members. The Laravel Jetstream-based team page, however, does not consult these permissions.

Instead, the controller calls belongsToTeam() to verify the requester is a member of the organization. After that check passes, it eagerly loads all pending invitations and members and serializes them into Inertia.js props. Those props are emitted in the page HTML, where any authenticated organization member can read them.

The disclosed data includes pending invitation email addresses and member identifiers. An attacker with low-privileged access to the organization can enumerate inviteees and members without ever calling the protected API.

Root Cause

The root cause is inconsistent authorization between the API layer and the web layer. The API enforces fine-grained permissions, while the Jetstream team page enforces only team membership. Permission checks are not duplicated on the Inertia-rendered route, so serialized props leak data that the API would reject.

Attack Vector

An authenticated user belonging to a Solidtime organization navigates to the team management page. The server returns the page with Inertia props containing pending invitation emails and member data. The attacker reads the props directly from the response body or browser developer tools. No elevated privileges, special tooling, or user interaction beyond authentication are required.

No verified public proof-of-concept code is available. Refer to the GitHub Security Advisory GHSA-33xq-wf67-c7vh for vendor technical details.

Detection Methods for CVE-2026-47236

Indicators of Compromise

Unexpected GET requests to the Jetstream team management route from accounts that lack invitations:view or members:view permissions.
Repeated team page loads from a single low-privileged session within a short time window, indicating scraping of Inertia props.
Outbound contact or phishing reports targeting email addresses that appear only on pending Solidtime invitations.

Detection Strategies

Review web server access logs for users without invitation or member permissions repeatedly accessing the team page route.
Compare API authorization denials for invitations:view and members:view against successful team page loads by the same user.
Inspect application logs for Inertia responses on the team page returning non-empty invitations or members arrays to low-privileged users.

Monitoring Recommendations

Alert on anomalous access patterns to the Solidtime team page from accounts with the minimum employee role.
Forward Solidtime application and access logs to a centralized log platform and retain them for forensic review.
Track pending invitation creation events and correlate with subsequent team page access by unrelated accounts.

How to Mitigate CVE-2026-47236

Immediate Actions Required

Upgrade Solidtime to version 0.12.2 or later, which restores permission checks on the team page.
Audit the membership of all Solidtime organizations and revoke access for any accounts that no longer require it.
Rotate or revoke pending invitations that may have been exposed prior to patching.

Patch Information

The issue is fixed in Solidtime 0.12.2. The patch enforces invitations:view and members:view permissions on the Jetstream team page so that Inertia props are filtered according to the requester's permissions. See the GitHub Solidtime Release v0.12.2 for release notes and upgrade instructions.

Workarounds

Restrict access to the Solidtime team page at the reverse proxy or web server layer to administrators only until the patch is applied.
Limit organization membership to trusted accounts and avoid issuing low-privileged employee roles in shared organizations during the exposure window.
Avoid sending invitations containing sensitive email addresses until the upgrade to 0.12.2 is complete.

bash

# Configuration example: upgrade Solidtime via Docker Compose
docker compose pull solidtime
docker compose up -d solidtime
docker compose exec solidtime php artisan migrate --force