Titra Sensitive Configuration Exposure Vulnerability in Global Settings Publication

A vulnerability in the Titra time tracking project, specifically in version 0.99.52, allows any authenticated user to access sensitive global settings through the 'globalsettings' Meteor publication. This publication lacks proper admin or role checks, enabling users to subscribe via DDP and receive confidential information such as API keys and secrets. At the time of publication, no public patch is available.

Impact

This vulnerability allows authenticated, non-admin users to retrieve all global settings, identify and collect API keys and secrets, and use the exposed credentials to access third-party services.