donetick vulnerabilities

Products

• donetick 2

Latest donetick CVEs

Newest publication first

1. CVE-2026-112045 donetick History Deletion model.go CanDeleteHistory improper authorization

   Published 2026-10-19

   Medium·CVSS 5.3 EPSS 0.24%

   A vulnerability was detected in donetick up to 0.1.82. The impacted element is the function CanDeleteHistory of the file internal/chore/model/model.go of the component History Deletion Handler. The manipulation of the argument AssignedTo results in improper authorization. The att...

2. CVE-2025-47945 Donetick Has Weak Default JWT Secret

   Published 2025-05-17

   Critical·CVSS 9.8 EPSS 0.69%

   Donetick an open-source app for managing tasks and chores. Prior to version 0.1.44, the application uses JSON Web Tokens (JWT) for authentication, but the signing secret has a weak default value. While the responsibility is left to the system administrator to change it, this appr...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.