Live › vulnerability › CVE-2026-112045
Go to dashboardIn donetick up to 0.1.82, the CanDeleteHistory check in the chore model does not properly authorize deletion when the AssignedTo argument is manipulated, so a remote caller can delete chore history entries they should not control. The maintainer says the impact is limited to trusted members of the same circle and treats it as a bug rather than a security flaw.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that self-host donetick up to 0.1.82 and let users outside a single trusted household or circle reach its API are the ones exposed. The maintainer says the impact is confined to members of the same circle, so single-circle deployments with only trusted users carry low practical risk. unknown whether any default configuration changes this.
No product ranges from the sources yet.
0.1.82 or older.internal/chore/model/model.go in the deployed source for the CanDeleteHistory function.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was detected in donetick up to 0.1.82. The impacted element is the function CanDeleteHistory of the file internal/chore/model/model.go of the component History Deletion Handler. The manipulation of the argument AssignedTo results in improper authorization. The attack can be launched remotely. The exploit is now public and may be used. The project maintainer explains: "The concerns about "IDOR" framing seem to be overstated in my opinion (...), as Circle members are already trusted collaborators. We will address this issue. However, since the impact is limited to trusted members within the same circle, I would classify this as a bug rather than a security vulnerability."
This page as .md · .json · in your agent: get_signal("CVE-2026-112045")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.