CVE-2026-112045 Details
Description
A vulnerability was detected in donetick up to 0.1.82. The impacted element is the function CanDeleteHistory of the file internal/chore/model/model.go of the component History Deletion Handler. The manipulation of the argument AssignedTo results in improper authorization. The attack can be launched remotely. The exploit is now public and may be used. The project maintainer explains: "The concerns about "IDOR" framing seem to be overstated in my opinion (...), as Circle members are already trusted collaborators. We will address this issue. However, since the impact is limited to trusted members within the same circle, I would classify this as a bug rather than a security vulnerability."
A vulnerability exists in Donetick versions up to 0.1.82 within the History Deletion Handler component. The issue arises in the CanDeleteHistory function, located in internal/chore/model/model.go. This vulnerability allows for improper authorization, as any authenticated member of a Donetick circle can delete the completion history of other members, provided the history entry was recorded without an explicit assignment. The flaw can be exploited remotely, and the deletion occurs silently, erasing any trace of the completed chore from the user's audit trail.
The vulnerability can be addressed by modifying the CanDeleteHistory function to remove the unconditional early return for history entries with a nil AssignedTo value. This change would ensure that deletion rights are properly restricted to chore creators, completers, or circle admins.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/donetick/donetick/ | [email protected] | Source CodeVendor |
| https://github.com/donetick/donetick/issues/711 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/donetick/donetick/security/advisories/GHSA-c545-2whr-g2v6 | [email protected] | AdvisoryBroken LinkVendor |
| https://vuldb.com/cve/CVE-2026-112045 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1009027 | [email protected] | Permission Required |
| https://vuldb.com/vuln/421693 | [email protected] | Permission Required |
| https://vuldb.com/vuln/421693/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-266 | Incorrect Privilege Assignment | [email protected] |
| CWE-285 | Improper Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| donetick | <= 0.1.82 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |