CVE-2026-112045: donetick History Deletion model.go CanDeleteHistory improper authorization
A vulnerability was detected in donetick up to 0.1.82. The impacted element is the function CanDeleteHistory of the file internal/chore/model/model.go of the component History Deletion Handler. The manipulation of the argument AssignedTo results in improper authorization. The attack can be launched remotely. The exploit is now public and may be used. The project maintainer explains: "The concerns about "IDOR" framing seem to be overstated in my opinion (...), as Circle members are already trusted collaborators. We will address this issue. However, since the impact is limited to trusted members within the same circle, I would classify this as a bug rather than a security vulnerability."
Affected Software
Event History
Frequently Asked Questions
Who can realistically exploit this issue?
The affected authorization check concerns users within the same Circle. The maintainer characterizes Circle members as trusted collaborators, so exposure is limited to authenticated users who are members of the relevant Circle.
What does an attacker need to do to exploit it?
An attacker needs to manipulate the AssignedTo argument used by the History Deletion Handler's CanDeleteHistory function. The attack can be launched remotely and requires low privileges; no user interaction is required.
Which versions are affected?
Donetick versions up to 0.1.82 are affected. The provided information does not identify a fixed version.
Is public exploit information available?
Yes. The exploit is public and may be used.