The vulnerability resides in the CanDeleteHistory function of donetick’s History Deletion Handler. By manipulating the AssignedTo parameter, an attacker can bypass the intended permission checks and delete the history records of other members within the same circle. This results in loss of traceable information and potential tampering of collaboration history.

'donetick' software, all versions up to and including 0.1.82. The vulnerability is present in the internal/chore/model/model.go file; versions newer than 0.1.82 presumably contain fixes, but the baseline is affected up to that point.

The CVSS score of 5.3 indicates a medium risk. Exploitation can be performed remotely once the attacker can construct a request that includes a malicious AssignedTo value. Because the targeting requires knowledge of other members’ credentials or IDs within the same circle, the exploitable scope is limited to trusted collaborators, but no clever defenses are in place. EPSS data is unavailable and the issue is not listed in the CISA KEV catalog.