{"id":"CVE-2026-112045","kind":"vulnerability","aliases":["CVE-2026-112045"],"related":[],"title":"donetick: history deletion lets users remove chores not assigned to them","description":"A vulnerability was detected in donetick up to 0.1.82. The impacted element is the function CanDeleteHistory of the file internal/chore/model/model.go of the component History Deletion Handler. The manipulation of the argument AssignedTo results in improper authorization. The attack can be launched remotely. The exploit is now public and may be used. The project maintainer explains: \"The concerns about \"IDOR\" framing seem to be overstated in my opinion (...), as Circle members are already trusted collaborators. We will address this issue. However, since the impact is limited to trusted members within the same circle, I would classify this as a bug rather than a security vulnerability.\"","summary":"In donetick up to 0.1.82, the CanDeleteHistory check in the chore model does not properly authorize deletion when the AssignedTo argument is manipulated, so a remote caller can delete chore history entries they should not control. The maintainer says the impact is limited to trusted members of the same circle and treats it as a bug rather than a security flaw.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["donetick","package","self-hosted"],"not_affected_if":["single-circle-trusted-users"],"how_to_check":"- Check the installed donetick version and whether it is `0.1.82` or older.\n- Look at `internal/chore/model/model.go` in the deployed source for the `CanDeleteHistory` function.\n- unknown whether the sources describe a configuration that changes exposure.","fix":"- unknown: the sources do not name a fixed version. The maintainer says they will address it.\n- Until a fix is released, limit who can reach the donetick API to trusted circle members.","status":"open","published_at":"2026-10-19T04:17:08+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T04:12:55+00:00","updated_at":"2026-10-25T04:12:55+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:12:55Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources do not name a fixed version. The maintainer says they will address it.\n- Until a fix is released, limit who can reach the donetick API to trusted circle members.","reach":"internet","title":"donetick: history deletion lets users remove chores not assigned to them","impact":"low","summary":"In donetick up to 0.1.82, the CanDeleteHistory check in the chore model does not properly authorize deletion when the AssignedTo argument is manipulated, so a remote caller can delete chore history entries they should not control. The maintainer says the impact is limited to trusted members of the same circle and treats it as a bug rather than a security flaw.","category":"package","nicknames":[],"who_cares":["donetick","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"A logged-in user deletes chore history belonging to other circle members.","analyst_note":"Confirm the fixed donetick version and whether the public exploit changes impact beyond same-circle members, using the NVD entry and the project repository.","how_to_check":"- Check the installed donetick version and whether it is `0.1.82` or older.\n- Look at `internal/chore/model/model.go` in the deployed source for the `CanDeleteHistory` function.\n- unknown whether the sources describe a configuration that changes exposure.","needs_analyst":true,"not_affected_if":["single-circle-trusted-users"],"who_is_affected":"Teams that self-host donetick up to 0.1.82 and let users outside a single trusted household or circle reach its API are the ones exposed. The maintainer says the impact is confined to members of the same circle, so single-circle deployments with only trusted users carry low practical risk. unknown whether any default configuration changes this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000656,"input_tokens":3412,"output_tokens":629,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112045':12A,15A '-2026':11A,14A '0.1.82':25B,90C 'address':158C 'alreadi':153C 'argument':41B,112C 'assign':9A 'assignedto':40B,113C 'attack':119C 'author':36B,117C 'bug':76B,180C 'caller':47B 'candeletehistori':27B,97C 'check':28B 'chore':7A,31B,50B 'circl':70B,150C,173C 'classifi':176C 'collabor':155C 'compon':104C 'concern':138C 'control':56B 'cve':10A,13A 'delet':3A,37B,49B,106C 'detect':85C 'donetick':1A,16B,22B,87C 'element':93C 'entri':52B 'explain':136C 'exploit':125C 'file':100C 'flaw':81B 'frame':141C 'function':96C 'handler':107C 'histori':2A,51B,105C 'host':20B 'howev':161C 'idor':140C 'impact':61B,92C,164C 'improp':116C 'internal/chore/model/model.go':101C 'issu':160C 'launch':122C 'let':4A 'limit':63B,166C 'maintain':58B,135C 'manipul':43B,109C 'may':130C 'member':66B,151C,169C 'model':32B 'opinion':148C 'overst':145C 'packag':17B 'project':134C 'proper':35B 'public':128C 'rather':77B,181C 'remot':46B,123C 'remov':6A 'result':114C 'say':59B 'secur':80B,184C 'seem':142C 'self':19B 'self-host':18B 'sinc':162C 'treat':72B 'trust':65B,154C,168C 'use':132C 'user':5A 'vulner':83C,185C 'within':170C 'would':175C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host donetick up to 0.1.82 and let users outside a single trusted household or circle reach its API are the ones exposed. The maintainer says the impact is confined to members of the same circle, so single-circle deployments with only trusted users carry low practical risk. unknown whether any default configuration changes this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T04:17:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112045","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112045","severity":null,"published_at":"2026-10-19T04:17:08+00:00","modified_at":"2026-10-19T18:17:01+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}