CVE-2026-42092 — titra is an open source time tracking project. In version

title: T1539 - Sensitive Configuration Exposure via DDP Subscription - CVE-2026-42092
id: scw-2026-05-04-ai-1
status: experimental
level: high
description: |
  This rule detects an authenticated user subscribing to the '/globalsettings' Meteor publication via DDP. In version 0.99.52 of titra, this publication returns sensitive configuration fields like google_secret, openai_apikey, and google_clientid without proper authorization checks, as described in CVE-2026-42092. This indicates a potential data exfiltration or reconnaissance attempt.
author: SCW Feed Engine (AI-generated)
date: 2026-05-04
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-42092/
tags:
  - attack.collection
  - attack.t1539
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/globalsettings'
      cs-method:
          - 'GET'
      sc-status:
          - '200'
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse