{"id":"CVE-2026-111640","summary":"DooTask through 1.9.66 Missing Authorization in OKR Comment Dialogs","details":"DooTask through 1.9.66 contains a missing authorization vulnerability in WebSocketDialog::checkDialog() that skips the membership check for dialogs with group_type 'okr'. Authenticated users can supply the dialog_id of OKR comment dialogs to msg__list, msg__one, or msg__send* endpoints to read and inject messages.","modified":"2026-10-24T02:49:27.177500651Z","published":"2026-10-16T17:39:10.978Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-639"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111640.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111640.json"},{"type":"ADVISORY","url":"https://hackmd.io/@hieuPenguinnn/dootask-okr-dialog-missing-membership-check"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111640"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/dootask-through-1.9.66-missing-authorization-in-okr-comment-dialogs"},{"type":"PACKAGE","url":"https://github.com/kuaifan/dootask"},{"type":"ARTICLE","url":"https://github.com/kuaifan/dootask/blob/v1.9.66/app/Models/WebSocketDialog.php#L976-L978"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/kuaifan/dootask","events":[{"introduced":"0"},{"last_affected":"6f111cd97dcbdaea23bf28768cd15dfa38bcae63"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0"},{"last_affected":"1.9.66"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"},{"range":[{"introduced":"0"},{"last_affected":"1.9.66"}],"source":"DESCRIPTION"}]}}],"versions":["v1.9.66","v1.9.59","v1.9.36","v1.9.18","v1.8.89","v1.8.69","v1.8.64","v1.8.45","v1.7.90","v1.7.81","v1.7.67","v1.7.55","v1.7.29","v1.7.23","v1.7.20","v1.7.14","v1.6.89","v1.6.51","v1.6.27","v1.6.10","v1.5.18","v1.5.5","v1.4.99","v1.4.88","v1.4.81","v1.4.67","v1.4.42","v1.4.35","v1.3.55","v1.3.38","v1.3.15","v1.2.75","v1.2.49","v1.2.21","v1.2.5","v1.1.66","v1.1.56","v1.1.15","v1.1.8","v1.1.3","v1.0.88","v1.0.65","v1.0.61","v1.0.51","v1.0.45","v1.0.37","v1.0.31","v1.0.0","v0.47.7","v0.46.74","v0.46.16","v0.45.64","v0.45.33","v0.44.91","v0.44.82","v0.44.74","v0.44.67","v0.44.53","v0.44.19","v0.44.15","v0.44.3","v0.43.73","v0.43.49","v0.43.18","v0.43.7","v0.42.85","v0.42.79","v0.42.74","v0.42.61","v0.42.57","v0.42.37","v0.42.26","v0.42.3","v0.42.0","v0.41.93","v0.41.84","v0.41.64","v0.41.55","v0.41.45","v0.40.78","v0.40.40","v0.39.97","v0.39.88","v0.39.73","v0.39.66","v0.39.52","v0.39.39","v0.39.21","v0.38.94","v0.38.91","v0.38.73","v0.38.70","v0.38.27","v0.37.98","v0.37.50","v0.37.17","v0.37.32","v0.36.97","v0.36.91","v0.36.84","v0.36.78","v0.36.75","v0.36.60","v0.36.49","v0.36.44","v0.36.36","v0.36.26","v0.36.15","v0.35.90","v0.35.84","v0.35.76","v0.35.48","v0.35.40","v0.35.20","v0.35.10","v0.34.95","v0.34.66","v0.34.59","v0.34.46","v0.34.28","v0.33.98","v0.33.91","v0.33.58","v0.33.54","v0.33.41","v0.33.37","v0.33.34","v0.32.9","0.32.9","v0.31.75","v0.31.65","v0.31.54","v0.31.43","v0.31.13","v0.31.8","v0.27.46","v0.27.26","v0.27.1","v0.26.86","v0.26.8","v0.26.6","v0.25.95","v0.25.84","v0.25.74","v0.25.68","v0.25.60","v0.25.52","v0.25.48","v0.25.42","v0.25.39","v0.13.0","v0.12.95","v0.12.77","v0.12.66","v0.12.40","v0.12.23","v0.12.19","v0.12.8","v0.11.96","v0.10.30","v0.10.21","v0.10.5","v0.9.83","v0.9.68","v0.8.22","v0.8.14","v0.8.2","v0.7.94","v0.7.73","v0.6.20","v0.6.13","v0.6.6","v0.5.94","v0.5.84","v0.5.59","v0.5.52","v0.5.58","v0.5.17","v0.5.8","v0.5.0","v0.4.99","v0.4.86","v0.4.78","v0.4.63","v0.4.58","v0.4.50","v0.4.28","v0.4.11","0.3.89","0.3.56","0.3.47","0.3.36","0.3.29"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111640.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}]}