CVE-2015-8346: app/views/timelog/_form.html.erb in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows...

Security readout for executives and security teams

This Redmine flaw could let a remote user see sensitive issue subject information through the time logging form. The sources name fixed Redmine releases but provide no CVSS score or active exploitation evidence. Risk depends on whether issue titles contain confidential customer, security, or business information. Exposure is likely limited to organizations running the listed older Redmine versions, especially where users can access time logging and issue subjects contain sensitive information. The bundle does not prove unauthenticated exposure. Prioritize remediation where Redmine is internet-accessible or issue titles contain sensitive information. This is not presented as actively exploited, but the fixed versions are old and upgrade validation should be routine. Mitigation focus: Upgrade Redmine to 2.6.8, 3.0.6, 3.1.2, or later supported releases.; Apply vendor distribution updates, including Debian guidance where applicable.; Restrict access to time logging until affected Redmine instances are patched..

Prepared

Jun 13, 2026, 14:44 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.