CVE-2026-112045Medium· 5.4▾ TwilightPoC availableA vulnerability was detected in donetick up to 0.1.82. The impacted element is the function CanDeleteHistory of the file internal/chore/model/model.go of the component History Deletion Handler. The manipulation of the argument AssignedTo…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 29.7 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
Exploit / PoC code exists
A vulnerability was detected in donetick up to 0.1.82. The impacted element is the function CanDeleteHistory of the file internal/chore/model/model.go of the component History Deletion Handler. The manipulation of the argument AssignedTo results in improper authorization. The attack can be launched remotely. The exploit is now public and may be used. The project maintainer explains: "The concerns about "IDOR" framing seem to be overstated in my opinion (...), as Circle members are already trusted collaborators. We will address this issue. However, since the impact is limited to trusted members within the same circle, I would classify this as a bug rather than a security vulnerability."
donetick 0.1.0donetick 0.1.1donetick 0.1.2donetick 0.1.3donetick 0.1.4donetick 0.1.5donetick 0.1.6donetick 0.1.7donetick 0.1.8donetick 0.1.9donetick 0.1.10donetick 0.1.11donetick 0.1.12donetick 0.1.13donetick 0.1.14donetick 0.1.15donetick 0.1.16donetick 0.1.17donetick 0.1.18donetick 0.1.19donetick 0.1.20donetick 0.1.21donetick 0.1.22donetick 0.1.23donetick 0.1.24donetick 0.1.25donetick 0.1.26donetick 0.1.27donetick 0.1.28donetick 0.1.29donetick 0.1.30donetick 0.1.31donetick 0.1.32donetick 0.1.33donetick 0.1.34donetick 0.1.35donetick 0.1.36donetick 0.1.37donetick 0.1.38donetick 0.1.39donetick 0.1.40donetick 0.1.41donetick 0.1.42donetick 0.1.43donetick 0.1.44donetick 0.1.45donetick 0.1.46donetick 0.1.47donetick 0.1.48donetick 0.1.49Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-10278Medium· 6.3YunaiV ruoyi-vue-pro transfer improper authorization
CVE-2025-10275Medium· 6.3YunaiV yudao-cloud transfer improper authorization
CVE-2025-10276Medium· 6.3YunaiV ruoyi-vue-pro transfer improper authorization
CVE-2026-114249High· 7.3dhikshitha29 Insurance-Management-System Policy Holder Update Form UpdatePolicyHolder-inc.php improper authorization
CVE-2026-114245High· 7.3dhikshitha29 Insurance-Management-System Add New Admin Form Admin-Register-inc.php improper authorization
CVE-2026-109605High· 7.3A security vulnerability has been detected in SourceCodester Simple Cafe Billing System 1.0