CVE-2026-112045

Name of the Vulnerable Software and Affected Versions donetick versions prior to 0.1.83

Description Improper authorization occurs in the History Deletion Handler component within the CanDeleteHistory() function located in the internal/chore/model/model.go file. A remote attacker can manipulate the AssignedTo argument to bypass authorization checks. This issue is related to Insecure Direct Object Reference (IDOR), a condition where an application provides direct access to objects based on user-supplied input.

Recommendations Update donetick to version 0.1.83 or later. As a temporary mitigation, restrict access to the History Deletion Handler component.