Donetick
Monthly
Improper authorization in Donetick's chore history deletion handler (versions up to and including 0.1.82) lets any authenticated member of a Circle delete chore history belonging to other members by manipulating the AssignedTo argument passed to CanDeleteHistory. The flaw is limited in scope: the attacker must already hold an account inside the victim's Circle, so it is not reachable by unauthenticated outsiders and does not cross circle boundaries, and the impact is confined to integrity and availability of history records with no data disclosure. Publicly available exploit code exists and the issue is documented in the upstream repository (issue #711) and GitHub advisory GHSA-c545-2whr-g2v6, though there is no evidence of confirmed active exploitation (CISA KEV) at the time of analysis; the maintainer disputes the IDOR framing, characterizing the behavior as a bug affecting trusted collaborators rather than a security vulnerability.
Donetick an open-source app for managing tasks and chores. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Improper authorization in Donetick's chore history deletion handler (versions up to and including 0.1.82) lets any authenticated member of a Circle delete chore history belonging to other members by manipulating the AssignedTo argument passed to CanDeleteHistory. The flaw is limited in scope: the attacker must already hold an account inside the victim's Circle, so it is not reachable by unauthenticated outsiders and does not cross circle boundaries, and the impact is confined to integrity and availability of history records with no data disclosure. Publicly available exploit code exists and the issue is documented in the upstream repository (issue #711) and GitHub advisory GHSA-c545-2whr-g2v6, though there is no evidence of confirmed active exploitation (CISA KEV) at the time of analysis; the maintainer disputes the IDOR framing, characterizing the behavior as a bug affecting trusted collaborators rather than a security vulnerability.
Donetick an open-source app for managing tasks and chores. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.