CVE-2026-111640: DooTask through 1.9.66 Missing Authorization in OKR Comment Dialogs

Q: Who can exploit this issue?

An attacker must be authenticated to DooTask. They also need the dialog_id of an OKR comment dialog; no user interaction is required.

Q: Which functionality is affected?

The authorization check is skipped specifically for dialogs whose group_type is "okr". The affected message operations are msg__list, msg__one, and msg__send* endpoints.

Q: What can a successful attacker do?

An authenticated user can read messages from OKR comment dialogs they are not authorized to access and inject messages into those dialogs.

Q: How can defenders identify possible exposure?

Review use of msg__list, msg__one, and msg__send* against OKR comment dialog IDs, particularly where the requesting authenticated user is not a member of the targeted dialog. Versions through 1.9.66 are identified as affected.

Published Oct 16, 2026

Updated

DooTask through 1.9.66 contains a missing authorization vulnerability in WebSocketDialog::checkDialog() that skips the membership check for dialogs with grouptype 'okr'. Authenticated users can supply the dialogid of OKR comment dialogs to msglist, msgone, or msgsend endpoints to read and inject messages.

Affected Software

1 affected component

dootask dootask<=1.9.66

Event History

Oct 16, 2026

CVE Published

via MITRE·05:39 PM

Data Sourced

via MITRE·05:39 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must be authenticated to DooTask. They also need the dialog_id of an OKR comment dialog; no user interaction is required.

Which functionality is affected?

The authorization check is skipped specifically for dialogs whose group_type is "okr". The affected message operations are msg__list, msg__one, and msg__send* endpoints.

What can a successful attacker do?

An authenticated user can read messages from OKR comment dialogs they are not authorized to access and inject messages into those dialogs.

How can defenders identify possible exposure?

Review use of msg__list, msg__one, and msg__send* against OKR comment dialog IDs, particularly where the requesting authenticated user is not a member of the targeted dialog. Versions through 1.9.66 are identified as affected.

CVE-2026-111640: DooTask through 1.9.66 Missing Authorization in OKR Comment Dialogs

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Which functionality is affected?

What can a successful attacker do?

How can defenders identify possible exposure?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which functionality is affected?

What can a successful attacker do?

How can defenders identify possible exposure?