CVE-2026-111640 Details
Description
DooTask through 1.9.66 contains a missing authorization vulnerability in WebSocketDialog::checkDialog() that skips the membership check for dialogs with group_type 'okr'. Authenticated users can supply the dialog_id of OKR comment dialogs to msg__list, msg__one, or msg__send* endpoints to read and inject messages.
A missing authorization vulnerability has been identified in DooTask versions through 1.9.66. The issue resides in the WebSocketDialog::checkDialog() method, which fails to perform a membership check for OKR comment dialogs. This oversight allows authenticated users to manipulate the dialog_id of OKR comment dialogs and use it with the msg__list, msg__one, or msg__send* endpoints to read and inject messages.
The vulnerability can be fixed by removing the unconditional return for OKR dialogs in the WebSocketDialog::checkDialog() method. This will ensure that all dialog types are subject to the same membership checks. Alternatively, if OKR dialogs are intended to be accessible to all members of the associated OKR objective, the method should explicitly verify the caller's participation before granting access.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackmd.io/@hieuPenguinnn/dootask-okr-dialog-missing-membership-check | CISA-ADP | ExploitRemedyTechnical Analysis |
| https://github.com/kuaifan/dootask/blob/v1.9.66/app/Models/WebSocketDialog.php#L976-L978 | [email protected] | Source CodeVendor |
| https://hackmd.io/@hieuPenguinnn/dootask-okr-dialog-missing-membership-check | [email protected] | ExploitRemedyTechnical Analysis |
| https://www.vulncheck.com/advisories/dootask-through-1.9.66-missing-authorization-in-okr-comment-dialogs | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| DooTask | <= 1.9.66 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2026 | New CVE Received | [email protected] |