CVE-2026-112045

donetick History Deletion model.go CanDeleteHistory improper authorization

State: Published
Severity: 5.3 Medium
Published: Oct 19, 2026
Updated: Oct 19, 2026
Reserved: Oct 18, 2026

Description

A vulnerability was detected in donetick up to 0.1.82. The impacted element is the function CanDeleteHistory of the file internal/chore/model/model.go of the component History Deletion Handler. The manipulation of the argument AssignedTo results in improper authorization. The attack can be launched remotely. The exploit is now public and may be used. The project maintainer explains: "The concerns about "IDOR" framing seem to be overstated in my opinion (...), as Circle members are already trusted collaborators. We will address this issue. However, since the impact is limited to trusted members within the same circle, I would classify this as a bug rather than a security vulnerability."

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	5.4 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C	VulDB
3.0	5.4 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C	VulDB
2.0	5.5 Medium	AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:C	VulDB

Weaknesses

CWE-285 Improper Authorization
CWE-266 Incorrect Privilege Assignment

Affected Products

Product	Versions
donetickn/a	0.1.0Affected 0.1.1Affected 0.1.2Affected 0.1.3Affected 0.1.4Affected 0.1.5Affected 0.1.6Affected 0.1.7Affected 0.1.8Affected 0.1.9Affected 0.1.10Affected 0.1.11Affected 0.1.12Affected 0.1.13Affected 0.1.14Affected 0.1.15Affected 0.1.16Affected 0.1.17Affected 0.1.18Affected 0.1.19Affected 0.1.20Affected 0.1.21Affected 0.1.22Affected 0.1.23Affected 0.1.24Affected and 58 more versions

References

VDB-421693 | donetick History Deletion model.go CanDeleteHistory improper authorizationvdb-entrytechnical-description
VDB-421693 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-112045 | CVE Analysis and Reportthird-party-advisory
Submit #1009027 | https://github.com/donetick/ donetick commit 0ca432c1f7731ef9c4c2f00aad7f2f845ef9c2b3 Improper Authorizationthird-party-advisory
https://github.com/donetick/donetick/issues/711exploitissue-tracking
https://github.com/donetick/donetick/security/advisories/GHSA-c545-2whr-g2v6broken-link
https://github.com/donetick/donetick/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.