CVE-2026-124817mediumCWE-284

CVE-2026-124817: medium-severity vulnerability in Clockinator Lite

Clockinator Lite < 1.1.0 - Unauthenticated Leave Record Modification

Published

Follow this CVE+ Monitor Clockinator Lite

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 5.3epss 0.1%
The Clockinator Lite WordPress plugin before 1.1.0 does not check authorisation or ownership when updating leave requests, allowing unauthenticated users to modify any leave record, including approving or rejecting requests and reassigning them to other users.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
Unknown · Clockinator Lite
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Clockinator Lite

In the same product, most dangerous first.

CVE-2026-124815CRITICALClockinator Lite < 1.1.0 - Unauthenticated SQLi via Record Deletion ActionsEPSS 0.2%