CVE-2026-111640

DooTask through 1.9.66 contains a missing authorization vulnerability in WebSocketDialog::checkDialog that skips the membership check for dialogs with grouptype 'okr'. Authenticated users can supply the dialogid of OKR comment dialogs to msglist, msgone, or msgsend endpoints to read and inject...

CVE-2026-111640

DooTask versions through 1.9.66 are vulnerable to a missing authorization flaw in the WebSocketDialog::checkDialog() function. The root cause is a failure to perform membership checks for dialogs with a group_type of 'okr' . Consequently, authenticated users can provide the dialog_id of these OKR...

EUVD-2026-103062

DooTask through 1.9.66 contains a missing authorization vulnerability in WebSocketDialog::checkDialog that skips the membership check for dialogs with grouptype 'okr'. Authenticated users can supply the dialogid of OKR comment dialogs to msglist, msgone, or msgsend endpoints to read and inject...

PT-2026-116039

DooTask through 1.9.66 contains a missing authorization vulnerability in WebSocketDialog::checkDialog that skips the membership check for dialogs with group type 'okr'. Authenticated users can supply the dialog id of OKR comment dialogs to msg list, msg one, or msg send endpoints to read and inje...