CVE-2026-112045

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-112045
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112045.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-112045
Aliases
  • GHSA-c545-2whr-g2v6
Published
2026-10-19T03:00:17Z
Modified
2026-10-20T02:45:16Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
donetick History Deletion model.go CanDeleteHistory improper authorization
Details

A vulnerability was detected in donetick up to 0.1.82. The impacted element is the function CanDeleteHistory of the file internal/chore/model/model.go of the component History Deletion Handler. The manipulation of the argument AssignedTo results in improper authorization. The attack can be launched remotely. The exploit is now public and may be used. The project maintainer explains: "The concerns about "IDOR" framing seem to be overstated in my opinion (...), as Circle members are already trusted collaborators. We will address this issue. However, since the impact is limited to trusted members within the same circle, I would classify this as a bug rather than a security vulnerability."

Database specific 
{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-266",
        "CWE-285"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112045.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "0.1.0"
                },
                {
                    "last_affected":  "0.1.0"
                },
                {
                    "introduced":  "0.1.1"
                },
                {
                    "last_affected":  "0.1.1"
                },
                {
                    "introduced":  "0.1.2"
                },
                {
                    "last_affected":  "0.1.2"
                },
                {
                    "introduced":  "0.1.3"
                },
                {
                    "last_affected":  "0.1.3"
                },
                {
                    "introduced":  "0.1.4"
                },
                {
                    "last_affected":  "0.1.4"
                },
                {
                    "introduced":  "0.1.5"
                },
                {
                    "last_affected":  "0.1.5"
                },
                {
                    "introduced":  "0.1.6"
                },
                {
                    "last_affected":  "0.1.6"
                },
                {
                    "introduced":  "0.1.7"
                },
                {
                    "last_affected":  "0.1.7"
                },
                {
                    "introduced":  "0.1.8"
                },
                {
                    "last_affected":  "0.1.8"
                },
                {
                    "introduced":  "0.1.9"
                },
                {
                    "last_affected":  "0.1.9"
                },
                {
                    "introduced":  "0.1.10"
                },
                {
                    "last_affected":  "0.1.10"
                },
                {
                    "introduced":  "0.1.11"
                },
                {
                    "last_affected":  "0.1.11"
                },
                {
                    "introduced":  "0.1.12"
                },
                {
                    "last_affected":  "0.1.12"
                },
                {
                    "introduced":  "0.1.13"
                },
                {
                    "last_affected":  "0.1.13"
                },
                {
                    "introduced":  "0.1.14"
                },
                {
                    "last_affected":  "0.1.14"
                },
                {
                    "introduced":  "0.1.15"
                },
                {
                    "last_affected":  "0.1.15"
                },
                {
                    "introduced":  "0.1.16"
                },
                {
                    "last_affected":  "0.1.16"
                },
                {
                    "introduced":  "0.1.17"
                },
                {
                    "last_affected":  "0.1.17"
                },
                {
                    "introduced":  "0.1.18"
                },
                {
                    "last_affected":  "0.1.18"
                },
                {
                    "introduced":  "0.1.19"
                },
                {
                    "last_affected":  "0.1.19"
                },
                {
                    "introduced":  "0.1.20"
                },
                {
                    "last_affected":  "0.1.20"
                },
                {
                    "introduced":  "0.1.21"
                },
                {
                    "last_affected":  "0.1.21"
                },
                {
                    "introduced":  "0.1.22"
                },
                {
                    "last_affected":  "0.1.22"
                },
                {
                    "introduced":  "0.1.23"
                },
                {
                    "last_affected":  "0.1.23"
                },
                {
                    "introduced":  "0.1.24"
                },
                {
                    "last_affected":  "0.1.24"
                },
                {
                    "introduced":  "0.1.25"
                },
                {
                    "last_affected":  "0.1.25"
                },
                {
                    "introduced":  "0.1.26"
                },
                {
                    "last_affected":  "0.1.26"
                },
                {
                    "introduced":  "0.1.27"
                },
                {
                    "last_affected":  "0.1.27"
                },
                {
                    "introduced":  "0.1.28"
                },
                {
                    "last_affected":  "0.1.28"
                },
                {
                    "introduced":  "0.1.29"
                },
                {
                    "last_affected":  "0.1.29"
                },
                {
                    "introduced":  "0.1.30"
                },
                {
                    "last_affected":  "0.1.30"
                },
                {
                    "introduced":  "0.1.31"
                },
                {
                    "last_affected":  "0.1.31"
                },
                {
                    "introduced":  "0.1.32"
                },
                {
                    "last_affected":  "0.1.32"
                },
                {
                    "introduced":  "0.1.33"
                },
                {
                    "last_affected":  "0.1.33"
                },
                {
                    "introduced":  "0.1.42"
                },
                {
                    "last_affected":  "0.1.42"
                },
                {
                    "introduced":  "0.1.49"
                },
                {
                    "last_affected":  "0.1.49"
                },
                {
                    "introduced":  "0.1.54"
                },
                {
                    "last_affected":  "0.1.54"
                },
                {
                    "introduced":  "0.1.55"
                },
                {
                    "last_affected":  "0.1.55"
                },
                {
                    "introduced":  "0.1.63"
                },
                {
                    "last_affected":  "0.1.63"
                },
                {
                    "introduced":  "0.1.65"
                },
                {
                    "last_affected":  "0.1.65"
                },
                {
                    "introduced":  "0.1.66"
                },
                {
                    "last_affected":  "0.1.66"
                },
                {
                    "introduced":  "0.1.67"
                },
                {
                    "last_affected":  "0.1.67"
                },
                {
                    "introduced":  "0.1.68"
                },
                {
                    "last_affected":  "0.1.68"
                },
                {
                    "introduced":  "0.1.69"
                },
                {
                    "last_affected":  "0.1.69"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/donetick/donetick

Affected ranges

Type
GIT
Repo
https://github.com/donetick/donetick
Events
Introduced
28ddb0a32d79b3d8f0f8a3e0530d2b69f4e8a669
Last Affected
9d9921d45efe336a1a17a81bb55d1a3af4b046a6
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0.1.34"
        },
        {
            "last_affected":  "0.1.34"
        },
        {
            "introduced":  "0.1.35"
        },
        {
            "last_affected":  "0.1.35"
        },
        {
            "introduced":  "0.1.36"
        },
        {
            "last_affected":  "0.1.36"
        },
        {
            "introduced":  "0.1.37"
        },
        {
            "last_affected":  "0.1.37"
        },
        {
            "introduced":  "0.1.38"
        },
        {
            "last_affected":  "0.1.38"
        },
        {
            "introduced":  "0.1.39"
        },
        {
            "last_affected":  "0.1.39"
        },
        {
            "introduced":  "0.1.40"
        },
        {
            "last_affected":  "0.1.40"
        },
        {
            "introduced":  "0.1.41"
        },
        {
            "last_affected":  "0.1.41"
        },
        {
            "introduced":  "0.1.43"
        },
        {
            "last_affected":  "0.1.43"
        },
        {
            "introduced":  "0.1.44"
        },
        {
            "last_affected":  "0.1.44"
        },
        {
            "introduced":  "0.1.45"
        },
        {
            "last_affected":  "0.1.45"
        },
        {
            "introduced":  "0.1.46"
        },
        {
            "last_affected":  "0.1.46"
        },
        {
            "introduced":  "0.1.47"
        },
        {
            "last_affected":  "0.1.47"
        },
        {
            "introduced":  "0.1.48"
        },
        {
            "last_affected":  "0.1.48"
        },
        {
            "introduced":  "0.1.50"
        },
        {
            "last_affected":  "0.1.50"
        },
        {
            "introduced":  "0.1.51"
        },
        {
            "last_affected":  "0.1.51"
        },
        {
            "introduced":  "0.1.52"
        },
        {
            "last_affected":  "0.1.52"
        },
        {
            "introduced":  "0.1.53"
        },
        {
            "last_affected":  "0.1.53"
        },
        {
            "introduced":  "0.1.56"
        },
        {
            "last_affected":  "0.1.56"
        },
        {
            "introduced":  "0.1.57"
        },
        {
            "last_affected":  "0.1.57"
        },
        {
            "introduced":  "0.1.58"
        },
        {
            "last_affected":  "0.1.58"
        },
        {
            "introduced":  "0.1.59"
        },
        {
            "last_affected":  "0.1.59"
        },
        {
            "introduced":  "0.1.60"
        },
        {
            "last_affected":  "0.1.60"
        },
        {
            "introduced":  "0.1.61"
        },
        {
            "last_affected":  "0.1.61"
        },
        {
            "introduced":  "0.1.62"
        },
        {
            "last_affected":  "0.1.62"
        },
        {
            "introduced":  "0.1.64"
        },
        {
            "last_affected":  "0.1.64"
        },
        {
            "introduced":  "0.1.70"
        },
        {
            "last_affected":  "0.1.70"
        },
        {
            "introduced":  "0.1.71"
        },
        {
            "last_affected":  "0.1.71"
        },
        {
            "introduced":  "0.1.72"
        },
        {
            "last_affected":  "0.1.72"
        },
        {
            "introduced":  "0.1.73"
        },
        {
            "last_affected":  "0.1.73"
        },
        {
            "introduced":  "0.1.74"
        },
        {
            "last_affected":  "0.1.74"
        },
        {
            "introduced":  "0.1.75"
        },
        {
            "last_affected":  "0.1.75"
        },
        {
            "introduced":  "0.1.76"
        },
        {
            "last_affected":  "0.1.76"
        },
        {
            "introduced":  "0.1.77"
        },
        {
            "last_affected":  "0.1.77"
        },
        {
            "introduced":  "0.1.78"
        },
        {
            "last_affected":  "0.1.78"
        },
        {
            "introduced":  "0.1.79"
        },
        {
            "last_affected":  "0.1.79"
        },
        {
            "introduced":  "0.1.80"
        },
        {
            "last_affected":  "0.1.80"
        },
        {
            "introduced":  "0.1.81"
        },
        {
            "last_affected":  "0.1.81"
        },
        {
            "introduced":  "0.1.82"
        },
        {
            "last_affected":  "0.1.82"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

0.*
0.1.34
0.1.35
0.1.36
0.1.37
0.1.38
0.1.39
0.1.44
0.1.45
0.1.46
0.1.47
0.1.50
0.1.51
0.1.52
0.1.53
0.1.56
0.1.57
0.1.58
0.1.60
0.1.61
0.1.62
0.1.64
0.1.70
0.1.71
0.1.72
0.1.73
0.1.74
0.1.75
0.1.76
0.1.77
0.1.78
0.1.79
0.1.80
0.1.81
0.1.82
v0.*
v0.0.33
v0.1.34
v0.1.35
v0.1.36
v0.1.37
v0.1.38
v0.1.39
v0.1.40
v0.1.41
v0.1.43
v0.1.44
v0.1.45
v0.1.46
v0.1.47
v0.1.48
v0.1.50
v0.1.51
v0.1.52
v0.1.53
v0.1.56
v0.1.57
v0.1.58
v0.1.59
v0.1.61
v0.1.62
v0.1.64
v0.1.70
v0.1.70-beta.1
v0.1.70-beta.10
v0.1.70-beta.2
v0.1.70-beta.3
v0.1.70-beta.4
v0.1.70-beta.5
v0.1.70-beta.6
v0.1.70-beta.9
v0.1.71
v0.1.73
v0.1.74
v0.1.75
v0.1.75-beta.1
v0.1.75-beta.10
v0.1.75-beta.11
v0.1.75-beta.12
v0.1.75-beta.13
v0.1.75-beta.14
v0.1.75-beta.15
v0.1.75-beta.16
v0.1.75-beta.2
v0.1.75-beta.3
v0.1.75-beta.4
v0.1.75-beta.5
v0.1.75-beta.6
v0.1.75-beta.7
v0.1.75-beta.8
v0.1.76-beta.1
v0.1.76-beta.10
v0.1.76-beta.11
v0.1.76-beta.12
v0.1.76-beta.13
v0.1.76-beta.14
v0.1.76-beta.15
v0.1.76-beta.16
v0.1.76-beta.17
v0.1.76-beta.18
v0.1.76-beta.19
v0.1.76-beta.20
v0.1.76-beta.21
v0.1.76-beta.22
v0.1.76-beta.23
v0.1.76-beta.8
v0.1.76-beta.9
v0.1.77
v0.1.77-beta.1
v0.1.77-beta.2
v0.1.77-beta.3
v0.1.77-beta.4
v0.1.77-beta.5
v0.1.78
v0.1.78-beta.1
v0.1.78-beta.2
v0.1.78-beta.3
v0.1.79
v0.1.80
v0.1.80-beta.1
v0.1.80-beta.2
v0.1.80-beta.3
v0.1.80-beta.4
v0.1.80-beta.5
v0.1.81
v0.1.81-beta.1
v0.1.81-beta.2
v0.1.81-beta.3
v0.1.81-beta.4
v0.1.81-beta.5
v0.1.81-beta.6
v0.1.81-beta.7
v0.1.82
v0.1.83-beta.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112045.json"