EUVD-2026-104054
GHSA-65cq-6v82-827q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as a Donetick circle member
-
ExploitManipulate AssignedTo in delete request
-
ExecutionBypass CanDeleteHistory authorization
-
ImpactDelete other members' chore history
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization verification
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated account that is a member of the same Donetick Circle as the victim (CVSS PR:L); the attacker abuses the History Deletion Handler by manipulating the AssignedTo argument so the CanDeleteHistory authorization check in internal/chore/model/model.go incorrectly permits deletion of another member's chore history. Limiting factors: exploitation is confined to trusted collaborators within the same circle - it is NOT exploitable by fully unauthenticated external attackers, nor across circle boundaries, and no user interaction is needed (UI:N). Impact is restricted to integrity/availability of history records (deletion); there is no data disclosure. |
| Impact | Signals point to a genuine but low-to-moderate priority issue rather than an urgent one. The CVSS 4.0 base score is 5.3 (Medium) with AV:N/AC:L/PR:L/UI:N, meaning network-reachable but requiring an already-authenticated low-privilege account; impact is limited to partial integrity and availability (VI:L/VA:L) with no confidentiality loss (VC:N). The SSVC/exploit-maturity flag E:P (proof-of-concept) aligns with the reported publicly available exploit, and a POC is indeed linked (donetick GitHub issue #711). No EPSS score was provided, and the CVE is NOT on the CISA KEV list, so there is no evidence of active exploitation - only proof-of-concept code. Crucially, the project maintainer publicly disputes the severity, arguing the impact is confined to trusted collaborators within the same Circle and classifying it as a bug rather than a security vulnerability; this is consistent with PR:L and the CWE-285 (Improper Authorization) framing. Net: a real authorization flaw with public POC, but the trust boundary (same-circle members only) and medium CVSS make this low real-world risk absent a vendor patch confirmation. EPSS data is missing, so widespread-exploitation probability cannot be quantified. |
| Exploit ScenarioDerived | An authenticated user who is already a member of a Donetick Circle crafts a request to the History Deletion Handler, manipulating the AssignedTo argument so the CanDeleteHistory check passes for records they should not control, deleting other circle members' chore history. A public proof-of-concept exists (GitHub issue #711), lowering the effort to reproduce. Because PR:L is required, a trusted-but-malicious or compromised circle member is the realistic actor. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Improper authorization in Donetick's chore history deletion handler (versions up to and including 0.1.82) lets any authenticated member of a Circle delete chore history belonging to other members by manipulating the AssignedTo argument passed to CanDeleteHistory. The flaw is limited in scope: the attacker must already hold an account inside the victim's Circle, so it is not reachable by unauthenticated outsiders and does not cross circle boundaries, and the impact is confined to integrity and availability of history records with no data disclosure. Publicly available exploit code exists and the issue is documented in the upstream repository (issue #711) and GitHub advisory GHSA-c545-2whr-g2v6, though there is no evidence of confirmed active exploitation (CISA KEV) at the time of analysis; the maintainer disputes the IDOR framing, characterizing the behavior as a bug affecting trusted collaborators rather than a security vulnerability.
RemediationAI
No vendor-released patch version is confirmed at time of analysis; the maintainer has acknowledged the report and stated the issue will be addressed, so operators should track GHSA-c545-2whr-g2v6 (https://github.com/donetick/donetick/security/advisories/GHSA-c545-2whr-g2v6) and issue #711 (https://github.com/donetick/donetick/issues/711) and upgrade as soon as a release above 0.1.82 ships. Where an immediate upgrade is not possible, compensating controls are: enforce strict Circle membership hygiene and remove or downgrade accounts that should not have delete rights over shared chores (trade-off: reduces collaboration features for legitimate household members); restrict network exposure of the Donetick instance to a private network or VPN and place it behind an authenticating reverse proxy (trade-off: loses convenient remote/mobile access); if the code is self-built, apply a local patch in internal/chore/model/model.go so CanDeleteHistory validates that the requested AssignedTo/record actually belongs to the authenticated caller within the same Circle, rather than trusting the supplied argument (trade-off: creates a fork that must be rebased on each upstream release); and retain or export chore history backups so deletions can be detected and restored, since the vulnerability's impact is destructive rather than disclosing.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Donetick is a self-hosted household/chore management application written in Go, organized around 'Circles' of collaborating members who share chores and completion history. The vulnerable code lives in internal/chore/model/model.go, where the CanDeleteHistory routine is intended to gate deletion of a chore's history entries. Root cause is CWE-285 (Improper Authorization): the function accepts an AssignedTo argument and derives its permission decision from that caller-supplied value rather than binding the check to the authenticated principal and its actual relationship to the target record, producing a broken object-level authorization (IDOR-class) pattern in which one circle member can direct deletion at another member's records. Because the authorization decision is made on a manipulable model field, the check fails open for any caller who can reach the history deletion handler; the requests travel over the standard networked API, hence AV:N, with PR:L reflecting the requirement of an authenticated in-circle account, UI:N, and impact limited to VC:N/VI:L/VA:L (history records can be destroyed but nothing is read out).
Know when Donetick gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Authenticated circle membership is required so PR:L; network-reachable with no user interaction (AV:N/UI:N); impact is deletion of records only, so C:N with I:L/A:L.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was detected in donetick up to 0.1.82. The impacted element is the function CanDeleteHistory of the file internal/chore/model/model.go of the component History Deletion Handler. The manipulation of the argument AssignedTo results in improper authorization. The attack can be launched remotely. The exploit is now public and may be used. The project maintainer explains: "The concerns about "IDOR" framing seem to be overstated in my opinion (...), as Circle members are already trusted collaborators. We will address this issue. However, since the impact is limited to trusted members within the same circle, I would classify this as a bug rather than a security vulnerability."
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB