The vulnerability is located in Dootask version 1.9.66, specifically in the WebSocketDialog::checkDialog() method, which fails to enforce a membership check for dialogs where the group_type is set to 'okr'. This omission allows any authenticated user to indicate the identifier of an OKR comment dialog and then use the msg__list, msg__one, or msg__send* endpoints to retrieve existing messages or inject new ones. Consequently, confidential OKR discussion content can be accessed by users who are not members of the relevant OKR group, and arbitrary messages can be posted, potentially disrupting team communications. The weakness is categorized as CWE-639, representing missing authorization checks.

Affected system: Kuaifan Dootask, all releases up to and including 1.9.66. Versions beyond 1.9.66 are not known to contain the flaw.

The CVSS score is 5.3, indicating a moderate level of risk. No EPSS score is available, so the current exploitation probability is unknown. Because the vulnerability requires an attacker to be already authenticated, the attack surface is limited to users with valid credentials. Although the flaw is not listed in the CISA KEV catalog, the missing authorization presents a clear pathway for sensitive data exposure and message injection within the OKR messaging feature.