{"id":"CVE-2026-112045","summary":"donetick History Deletion model.go CanDeleteHistory improper authorization","details":"A vulnerability was detected in donetick up to 0.1.82. The impacted element is the function CanDeleteHistory of the file internal/chore/model/model.go of the component History Deletion Handler. The manipulation of the argument AssignedTo results in improper authorization. The attack can be launched remotely. The exploit is now public and may be used. The project maintainer explains: \"The concerns about \"IDOR\" framing seem to be overstated in my opinion (...), as Circle members are already trusted collaborators. We will address this issue. However, since the impact is limited to trusted members within the same circle, I would classify this as a bug rather than a security vulnerability.\"","aliases":["GHSA-c545-2whr-g2v6"],"modified":"2026-10-20T02:45:16.906530724Z","published":"2026-10-19T03:00:17.338Z","database_specific":{"cna_assigner":"VulDB","cwe_ids":["CWE-266","CWE-285"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112045.json","unresolved_ranges":[{"extracted_events":[{"introduced":"0.1.0"},{"last_affected":"0.1.0"},{"introduced":"0.1.1"},{"last_affected":"0.1.1"},{"introduced":"0.1.2"},{"last_affected":"0.1.2"},{"introduced":"0.1.3"},{"last_affected":"0.1.3"},{"introduced":"0.1.4"},{"last_affected":"0.1.4"},{"introduced":"0.1.5"},{"last_affected":"0.1.5"},{"introduced":"0.1.6"},{"last_affected":"0.1.6"},{"introduced":"0.1.7"},{"last_affected":"0.1.7"},{"introduced":"0.1.8"},{"last_affected":"0.1.8"},{"introduced":"0.1.9"},{"last_affected":"0.1.9"},{"introduced":"0.1.10"},{"last_affected":"0.1.10"},{"introduced":"0.1.11"},{"last_affected":"0.1.11"},{"introduced":"0.1.12"},{"last_affected":"0.1.12"},{"introduced":"0.1.13"},{"last_affected":"0.1.13"},{"introduced":"0.1.14"},{"last_affected":"0.1.14"},{"introduced":"0.1.15"},{"last_affected":"0.1.15"},{"introduced":"0.1.16"},{"last_affected":"0.1.16"},{"introduced":"0.1.17"},{"last_affected":"0.1.17"},{"introduced":"0.1.18"},{"last_affected":"0.1.18"},{"introduced":"0.1.19"},{"last_affected":"0.1.19"},{"introduced":"0.1.20"},{"last_affected":"0.1.20"},{"introduced":"0.1.21"},{"last_affected":"0.1.21"},{"introduced":"0.1.22"},{"last_affected":"0.1.22"},{"introduced":"0.1.23"},{"last_affected":"0.1.23"},{"introduced":"0.1.24"},{"last_affected":"0.1.24"},{"introduced":"0.1.25"},{"last_affected":"0.1.25"},{"introduced":"0.1.26"},{"last_affected":"0.1.26"},{"introduced":"0.1.27"},{"last_affected":"0.1.27"},{"introduced":"0.1.28"},{"last_affected":"0.1.28"},{"introduced":"0.1.29"},{"last_affected":"0.1.29"},{"introduced":"0.1.30"},{"last_affected":"0.1.30"},{"introduced":"0.1.31"},{"last_affected":"0.1.31"},{"introduced":"0.1.32"},{"last_affected":"0.1.32"},{"introduced":"0.1.33"},{"last_affected":"0.1.33"},{"introduced":"0.1.42"},{"last_affected":"0.1.42"},{"introduced":"0.1.49"},{"last_affected":"0.1.49"},{"introduced":"0.1.54"},{"last_affected":"0.1.54"},{"introduced":"0.1.55"},{"last_affected":"0.1.55"},{"introduced":"0.1.63"},{"last_affected":"0.1.63"},{"introduced":"0.1.65"},{"last_affected":"0.1.65"},{"introduced":"0.1.66"},{"last_affected":"0.1.66"},{"introduced":"0.1.67"},{"last_affected":"0.1.67"},{"introduced":"0.1.68"},{"last_affected":"0.1.68"},{"introduced":"0.1.69"},{"last_affected":"0.1.69"}],"source":"AFFECTED_FIELD"}]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112045.json"},{"type":"WEB","url":"https://github.com/donetick/donetick/"},{"type":"REPORT","url":"https://github.com/donetick/donetick/issues/711"},{"type":"ADVISORY","url":"https://github.com/donetick/donetick/security/advisories/GHSA-c545-2whr-g2v6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112045"},{"type":"ADVISORY","url":"https://vuldb.com/cve/CVE-2026-112045"},{"type":"ADVISORY","url":"https://vuldb.com/submit/1009027"},{"type":"ADVISORY","url":"https://vuldb.com/vuln/421693"},{"type":"REPORT","url":"https://vuldb.com/vuln/421693/cti"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/donetick/donetick","events":[{"introduced":"28ddb0a32d79b3d8f0f8a3e0530d2b69f4e8a669"},{"last_affected":"9d9921d45efe336a1a17a81bb55d1a3af4b046a6"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"0.1.34"},{"last_affected":"0.1.34"},{"introduced":"0.1.35"},{"last_affected":"0.1.35"},{"introduced":"0.1.36"},{"last_affected":"0.1.36"},{"introduced":"0.1.37"},{"last_affected":"0.1.37"},{"introduced":"0.1.38"},{"last_affected":"0.1.38"},{"introduced":"0.1.39"},{"last_affected":"0.1.39"},{"introduced":"0.1.40"},{"last_affected":"0.1.40"},{"introduced":"0.1.41"},{"last_affected":"0.1.41"},{"introduced":"0.1.43"},{"last_affected":"0.1.43"},{"introduced":"0.1.44"},{"last_affected":"0.1.44"},{"introduced":"0.1.45"},{"last_affected":"0.1.45"},{"introduced":"0.1.46"},{"last_affected":"0.1.46"},{"introduced":"0.1.47"},{"last_affected":"0.1.47"},{"introduced":"0.1.48"},{"last_affected":"0.1.48"},{"introduced":"0.1.50"},{"last_affected":"0.1.50"},{"introduced":"0.1.51"},{"last_affected":"0.1.51"},{"introduced":"0.1.52"},{"last_affected":"0.1.52"},{"introduced":"0.1.53"},{"last_affected":"0.1.53"},{"introduced":"0.1.56"},{"last_affected":"0.1.56"},{"introduced":"0.1.57"},{"last_affected":"0.1.57"},{"introduced":"0.1.58"},{"last_affected":"0.1.58"},{"introduced":"0.1.59"},{"last_affected":"0.1.59"},{"introduced":"0.1.60"},{"last_affected":"0.1.60"},{"introduced":"0.1.61"},{"last_affected":"0.1.61"},{"introduced":"0.1.62"},{"last_affected":"0.1.62"},{"introduced":"0.1.64"},{"last_affected":"0.1.64"},{"introduced":"0.1.70"},{"last_affected":"0.1.70"},{"introduced":"0.1.71"},{"last_affected":"0.1.71"},{"introduced":"0.1.72"},{"last_affected":"0.1.72"},{"introduced":"0.1.73"},{"last_affected":"0.1.73"},{"introduced":"0.1.74"},{"last_affected":"0.1.74"},{"introduced":"0.1.75"},{"last_affected":"0.1.75"},{"introduced":"0.1.76"},{"last_affected":"0.1.76"},{"introduced":"0.1.77"},{"last_affected":"0.1.77"},{"introduced":"0.1.78"},{"last_affected":"0.1.78"},{"introduced":"0.1.79"},{"last_affected":"0.1.79"},{"introduced":"0.1.80"},{"last_affected":"0.1.80"},{"introduced":"0.1.81"},{"last_affected":"0.1.81"},{"introduced":"0.1.82"},{"last_affected":"0.1.82"}]}}],"versions":["0.1.34","0.1.35","0.1.36","0.1.37","0.1.38","0.1.39","0.1.44","0.1.45","0.1.46","0.1.47","0.1.50","0.1.51","0.1.52","0.1.53","0.1.56","0.1.57","0.1.58","0.1.60","0.1.61","0.1.62","0.1.64","0.1.70","0.1.71","0.1.72","0.1.73","0.1.74","0.1.75","0.1.76","0.1.77","0.1.78","0.1.79","0.1.80","0.1.81","0.1.82","v0.1.83-beta.1","v0.1.82","v0.1.81-beta.7","v0.1.81","v0.1.81-beta.6","v0.1.81-beta.5","v0.1.81-beta.4","v0.1.81-beta.3","v0.1.81-beta.2","v0.1.81-beta.1","v0.1.80","v0.1.80-beta.5","v0.1.80-beta.4","v0.1.80-beta.3","v0.1.80-beta.2","v0.1.80-beta.1","v0.1.79","v0.1.78-beta.3","v0.1.78","v0.1.78-beta.2","v0.1.78-beta.1","v0.1.77-beta.5","v0.1.77","v0.1.77-beta.4","v0.1.77-beta.3","v0.1.77-beta.2","v0.1.77-beta.1","v0.1.76-beta.23","v0.1.76-beta.22","v0.1.76-beta.21","v0.1.76-beta.20","v0.1.76-beta.19","v0.1.76-beta.18","v0.1.76-beta.17","v0.1.76-beta.16","v0.1.76-beta.13","v0.1.76-beta.12","v0.1.76-beta.15","v0.1.76-beta.14","v0.1.76-beta.11","v0.1.76-beta.10","v0.1.76-beta.9","v0.1.76-beta.8","v0.1.76-beta.1","v0.1.75","v0.1.75-beta.16","v0.1.75-beta.15","v0.1.75-beta.14","v0.1.75-beta.13","v0.1.75-beta.12","v0.1.75-beta.11","v0.1.75-beta.10","v0.1.75-beta.8","v0.1.75-beta.7","v0.1.75-beta.6","v0.1.75-beta.5","v0.1.75-beta.4","v0.1.75-beta.3","v0.1.75-beta.2","v0.1.75-beta.1","v0.1.74","v0.1.73","v0.1.71","v0.1.70-beta.10","v0.1.70","v0.1.70-beta.9","v0.1.70-beta.6","v0.1.70-beta.5","v0.1.70-beta.4","v0.1.70-beta.3","v0.1.70-beta.2","v0.1.70-beta.1","v0.1.64","v0.1.62","v0.1.61","v0.1.59","v0.1.58","v0.1.57","v0.1.56","v0.1.53","v0.1.52","v0.1.51","v0.1.50","v0.1.48","v0.1.47","v0.1.46","v0.1.45","v0.1.44","v0.1.43","v0.1.41","v0.1.40","v0.1.39","v0.1.38","v0.1.37","v0.1.36","v0.1.35","v0.1.34","v0.0.33"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112045.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}]}