donetick CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

LOW donetick CVE published 2026-10-19

CVE-2026-112045

A vulnerability was detected in donetick up to 0.1.82, impacting the History Deletion Handler's CanDeleteHistory function in internal/chore/model/model.go. The issue involves improper authorization due to manipulation of the AssignedTo argument, allowing remote attacks. The project maintainer views this as a bug rather than a security vulnerability, given its limited impact to trusted circle members.