CVE-2026-47236: Solidtime Authorization Bypass Exposes Team Members and Invitations

Technical summary

The vulnerability is an authorization bypass (CWE-863) affecting Solidtime versions prior to 0.12.2. The team page endpoint uses belongsToTeam() for access control, which grants broad authorization based on organizational membership alone. However, the same endpoint serializes sensitive data—pending invitation email addresses and member information—into Inertia props sent to the client, bypassing the granular invitations:view and members:view permission gates that protect the dedicated API endpoints. This creates an inconsistency where users denied API access can still retrieve the same information through page-level data exposure. The vulnerability requires user authentication and does not involve network complexity; it is triggered through standard web requests.

Business impact

This vulnerability exposes organizational structure and invitation data to internal users who should not have visibility. For organizations using Solidtime to manage contractor or consultant onboarding, the exposure of pending invitation emails could reveal hiring plans, partner engagements, or recruitment timelines to staff without authorization. More broadly, it violates the principle of least privilege by allowing all team members to access member lists and pending invitations when role-based permissions explicitly restrict such access. The reputational and operational impact is limited because it affects only internal visibility, but it may breach organizational governance policies and compliance frameworks that mandate role-based access controls.

Affected systems

Solidtime versions prior to 0.12.2 are affected. This is an open-source project, so the impact depends on deployment scope—organizations self-hosting Solidtime on that version are vulnerable. The vulnerability requires an authenticated user account within the Solidtime organization, meaning external attackers cannot exploit it directly. Solidtime does not appear in vendor-supplied patch advisories as a commercial product, confirming its open-source status. No CVE vendor/product mappings were provided, indicating limited tracked deployment in enterprise vendor ecosystems.

Exploitability

The vulnerability is straightforward to exploit but requires valid authentication. Any employee with an active Solidtime account in an organization can navigate to the team page and inspect the serialized Inertia props (via browser developer tools or by examining the page source) to extract pending invitation email addresses and member information. No special techniques, network access from outside the organization, or user interaction are required beyond standard web browsing. The attack surface is the team management web interface, not the API. The CVSS score of 4.3 reflects the low-complexity nature of the attack, required user authentication, and limited confidentiality impact (information disclosure rather than system compromise). The vulnerability is not listed in the KEV (Known Exploited Vulnerabilities) catalog, suggesting no active exploitation in the wild has been documented.

Remediation

Organizations using Solidtime must upgrade to version 0.12.2 or later, which patches the authorization bypass by implementing proper permission checks on the team page endpoint. The patch enforces invitations:view and members:view permissions before serializing sensitive data into Inertia props, bringing the web interface in line with the API's existing permission model. No workarounds are available short of upgrading. Self-hosted instances should prioritize this patch to prevent unauthorized internal data exposure.

Patch guidance

Upgrade Solidtime to version 0.12.2 or later. Since Solidtime is open-source and typically self-hosted, administrators should review the project's release notes and deployment documentation for upgrade procedures. The patch was released on 2026-06-12 (published date). Verify the installed version via the Solidtime admin panel or by checking the deployed source code version tag. If your instance is managed through a container or package manager, ensure the update mechanism pulls from the official Solidtime repository.

Detection guidance

To detect exploitation, examine web server access logs for repeated requests to the team page endpoint (typically /team or similar routes) by users who do not hold invitations:view or members:view roles. Monitor for unusual patterns of page access that precede or coincide with privilege escalation or lateral movement attempts. If available, enable debug logging in Solidtime to capture Inertia prop serialization and review for unauthorized access to sensitive fields (invitation.email, members). Additionally, audit which users have accessed the team page and correlate this with their stated job functions and assigned permissions; access by administrative or non-team-manager accounts may indicate reconnaissance.

Why prioritize this

Although the CVSS score is moderate (4.3), this vulnerability should be prioritized for organizations with sensitive hiring or partner engagement timelines. The confidentiality impact is real but limited in scope—it affects internal information disclosure rather than system availability or integrity. However, prioritization depends on your organizational risk appetite regarding internal data exposure and compliance posture. If your governance framework mandates strict role-based access control enforcement, this vulnerability represents a control gap that should be remediated promptly. Organizations with fewer than 50 employees or non-sensitive onboarding patterns may deprioritize in favor of higher-severity issues, but organizations managing large contractor networks or competitive hiring should patch sooner.

Risk score, explained

The CVSS 3.1 score of 4.3 (MEDIUM) reflects: (1) network-accessible attack surface (AV:N); (2) low attack complexity requiring only standard web requests and valid authentication (AC:L, PR:L); (3) no user interaction needed (UI:N); (4) unauthorized scope not expanded (S:U); (5) low confidentiality impact due to limited data exposure and requirement for prior authentication (C:L); and (6) no integrity or availability impact (I:N, A:N). The score appropriately reflects an authorization bypass that leaks organizational information to insiders, rather than a critical system compromise. The absence from KEV indicates CISA has not yet flagged active exploitation, which may justify deferral in resource-constrained environments, though active monitoring remains wise.

Frequently asked questions