In titra version 0.99.52, the globalsettings Meteor publication does not enforce access control, allowing any authenticated user to subscribe via DDP and retrieve sensitive configuration data. This exposure includes secrets like google_secret, openai_apikey, and google_clientid, which should be restricted to administrative roles. The vulnerability is categorized under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and has a CVSS 3.1 base score of 6.5, indicating a medium severity. No patch or official fix has been released as of the publication date.

An authenticated user can access sensitive configuration secrets that could potentially be used to compromise integrations or services relying on these credentials. While the vulnerability does not allow direct system compromise or denial of service, the exposure of secrets can lead to further attacks or unauthorized access to third-party services.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected version 0.99.52 by limiting authenticated user privileges or deploying compensating controls to protect sensitive configuration data. Monitor vendor channels for updates or patches addressing this issue.