DooTask CVE-2026-111640

Exploitation requires a valid authenticated DooTask account (PR:L) and a target dialog whose group_type is 'okr' - the membership check is skipped only for OKR comment dialogs, so non-OKR dialogs remain protected. The attacker must also obtain or guess the numeric dialog_id of the target OKR comment dialog to pass to msg__list, msg__one, or msg__send* endpoints. Limiting factors: authentication is mandatory (no unauthenticated access), the scope is confined to OKR-type dialogs, and impact is bounded to reading and injecting chat messages (low confidentiality/integrity, no availability or system compromise). No special non-default configuration or user interaction is needed beyond holding any authenticated session.

This is a genuine but moderate-severity access-control flaw (CWE-639, IDOR) rather than a critical priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N) is internally consistent with the description: network-reachable, low attack complexity, but requiring an authenticated low-privilege account (PR:L) and yielding only low confidentiality and integrity impact (read and inject chat messages) with no availability impact. No EPSS score was supplied, the CVE is NOT on the CISA KEV list, and no explicit POC=YES flag was provided - so exploitation status is 'no public exploit identified at time of analysis.' However, a detailed third-party technical writeup (hackmd) and a direct link to the vulnerable source lines (WebSocketDialog.php#L976-L978) are referenced, which materially lowers the effort to develop a working exploit even absent packaged code. The signals are consistent with each other: a mid-range CVSS, no confirmed in-the-wild activity, and no EPSS to contradict that - pointing to a real-but-not-urgent authorization bug whose main risk is insider or compromised-account misuse of OKR comment data, not mass unauthenticated exploitation.

An authenticated DooTask user who is not a member of a given OKR supplies the dialog_id of that OKR's comment dialog to the msg__list or msg__send endpoints; because checkDialog() skips the membership check for group_type 'okr', the attacker reads confidential OKR discussion and can inject forged messages. A public technical writeup describing the exact flaw and vulnerable code lines exists, though no packaged exploit was confirmed in the provided data.