Unvalidated note_type Parameter in mc_issue_update SOAP Endpoint Allows creation of TIME_TRACKING and REMINDER Notes. The SOAP path passes the user-supplied note_type integer directly to bugnote_add() without validating that the user is authorized to create that type of note. If the user's access level is higher than $g_time_tracking_view_threshold, they can also inject arbitrary hours into billing reports. REST API also allows injection of TIME_TRACKING notes (but not REMINDER) through the same mc_issue_update() function.