In solidtime 0.12.0, the PUT /api/v1/organizations/{organization}/time-entries/{timeEntry} endpoint accepts a timeEntry UUID from a different organization if the caller has the time-entries:update:all permission scoped to their own organization. This allows an attacker to modify a foreign time entry and associate it with objects in their own organization, bypassing intended authorization checks. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). It was patched in version 0.12.1.

The vulnerability allows an attacker with elevated permissions in one organization to modify time entries belonging to another organization by referencing their UUIDs. This leads to unauthorized integrity modification of data across organizational boundaries. There is no impact on confidentiality or availability. No known exploits are reported in the wild.

Upgrade solidtime to version 0.12.1 or later, where this authorization bypass vulnerability has been patched. Since this is an open-source product and not a cloud service, users must apply the update themselves. Patch status is confirmed by the vendor advisory stating the issue is fixed in 0.12.1.