---
id: "CVE-2026-112045"
kind: "vulnerability"
aliases: ["CVE-2026-112045"]
title: "donetick: history deletion lets users remove chores not assigned to them"
severity: "medium"
cvss: 5.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["donetick", "package", "self-hosted"]
not_affected_if: ["single-circle-trusted-users"]
published_at: "2026-10-19T04:17:08+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T04:12:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112045", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# donetick: history deletion lets users remove chores not assigned to them

In donetick up to 0.1.82, the CanDeleteHistory check in the chore model does not properly authorize deletion when the AssignedTo argument is manipulated, so a remote caller can delete chore history entries they should not control. The maintainer says the impact is limited to trusted members of the same circle and treats it as a bug rather than a security flaw.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed donetick version and whether it is `0.1.82` or older.
- Look at `internal/chore/model/model.go` in the deployed source for the `CanDeleteHistory` function.
- unknown whether the sources describe a configuration that changes exposure.

## Fix

- unknown: the sources do not name a fixed version. The maintainer says they will address it.
- Until a fix is released, limit who can reach the donetick API to trusted circle members.

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112045

## From the sources

A vulnerability was detected in donetick up to 0.1.82. The impacted element is the function CanDeleteHistory of the file internal/chore/model/model.go of the component History Deletion Handler. The manipulation of the argument AssignedTo results in improper authorization. The attack can be launched remotely. The exploit is now public and may be used. The project maintainer explains: "The concerns about "IDOR" framing seem to be overstated in my opinion (...), as Circle members are already trusted collaborators. We will address this issue. However, since the impact is limited to trusted members within the same circle, I would classify this as a bug rather than a security vulnerability."

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_