{"affected":[{"product":"titra","source":"CNA: GitHub_M","vendor":"titraio","versions":[{"status":"affected","version":"<= 1.0.3"}]}],"cveId":"CVE-2026-63497","cwes":["CWE-74"],"description":"titra is an open source time tracking project. In versions 1.0.3 and prior, authenticated API users can abuse the customfields object to inject or overwrite top-level fields in MongoDB documents. At time of publication, there are no publicly known patches.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1794257572375,"publishedAt":1794257572375,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/titraio/titra/security/advisories/GHSA-cphv-qx83-x397"}],"remediation":[],"revision":"2fb981c3b987b0e8627eccd4b661c4c7d164189e696f107332077be5dca71ad9","sources":[{"modifiedAt":1794257572375,"name":"CNA: GitHub_M","retrievedAt":1794258608602,"url":"https://www.cve.org/CVERecord?id=CVE-2026-63497"}],"ssvc":null,"status":"published","title":"titra: residual mass assignment via customfields in timeentry/create and project/task/create","updatedAt":1794258608602}