CVE-2026-111640

DooTask through 1.9.66 contains a missing authorization vulnerability in WebSocketDialog::checkDialog that skips the membership check for dialogs with grouptype 'okr'. Authenticated users can supply the dialogid of OKR comment dialogs to msglist, msgone, or msgsend endpoints to read and inject...

CVE-2026-111640 DooTask through 1.9.66 Missing Authorization in OKR Comment Dialogs

DooTask through 1.9.66 contains a missing authorization vulnerability in WebSocketDialog::checkDialog that skips the membership check for dialogs with grouptype 'okr'. Authenticated users can supply the dialogid of OKR comment dialogs to msglist, msgone, or msgsend endpoints to read and inject...

CVE-2026-111640

DooTask versions through 1.9.66 are vulnerable to a missing authorization flaw in the WebSocketDialog::checkDialog() function. The root cause is a failure to perform membership checks for dialogs with a group_type of 'okr' . Consequently, authenticated users can provide the dialog_id of these OKR...

CVE-2026-111640 DooTask through 1.9.66 Missing Authorization in OKR Comment Dialogs

DooTask through 1.9.66 contains a missing authorization vulnerability in WebSocketDialog::checkDialog that skips the membership check for dialogs with grouptype 'okr'. Authenticated users can supply the dialogid of OKR comment dialogs to msglist, msgone, or msgsend endpoints to read and inject...

EUVD-2026-103062

DooTask through 1.9.66 contains a missing authorization vulnerability in WebSocketDialog::checkDialog that skips the membership check for dialogs with grouptype 'okr'. Authenticated users can supply the dialogid of OKR comment dialogs to msglist, msgone, or msgsend endpoints to read and inject...

CVE-2026-111640

DooTask through 1.9.66 contains a missing authorization vulnerability in WebSocketDialog::checkDialog that skips the membership check for dialogs with grouptype 'okr'. Authenticated users can supply the dialogid of OKR comment dialogs to msglist, msgone, or msgsend endpoints to read and inject...

CVE-2026-111640 DooTask through 1.9.66 Missing Authorization in OKR Comment Dialogs

DooTask through 1.9.66 contains a missing authorization vulnerability in WebSocketDialog::checkDialog that skips the membership check for dialogs with grouptype 'okr'. Authenticated users can supply the dialogid of OKR comment dialogs to msglist, msgone, or msgsend endpoints to read and inject...

PT-2026-116039

🚨 CVE-2026-111640 DooTask through 1.9.66 contains a missing authorization vulnerability in WebSocketDialog::checkDialog that skips the membership check for dialogs with group type 'okr'. Authenticated users can supply the dialog id of OKR comment dialogs to msg list, msg one, or msg send endpoint...

CVE-2026-111640: Authorization Bypass Through User-Controlled Key

DooTask through 1.9.66 contains a missing authorization vulnerability in WebSocketDialog::checkDialog that skips the membership check for dialogs with grouptype 'okr'. Authenticated users can supply the dialogid of OKR comment dialogs to msglist, msgone, or msgsend endpoints to read and inject...

Kuaifan Dootask Authorization Issue Vulnerability

Kuaifan DooTask versions 1.9.66 and earlier have an authorization issue vulnerability. This vulnerability stems from a lack of authorization verification in WebSocketDialog::checkDialog. It skips the membership checks for dialog boxes with grouptype set to 'okr'. Certified users can exploit this...

CVE-2026-29828

DooTask v1.6.27 has a Cross-Site Scripting XSS vulnerability in the /manage/project/ page via the input field projectDesc...

EUVD-2026-13730

DooTask v1.6.27 has a Cross-Site Scripting XSS vulnerability in the /manage/project/ page via the input field projectDesc...

CVE-2026-29828

DooTask v1.6.27 has a Cross-Site Scripting XSS vulnerability in the /manage/project/ page via the input field projectDesc...

CVE-2026-29828

DooTask v1.6.27 has a Cross-Site Scripting XSS vulnerability in the /manage/project/ page via the input field projectDesc...

CVE-2026-29828: Improper Neutralization of Input During Web Page Generation

DooTask v1.6.27 has a Cross-Site Scripting XSS vulnerability in the /manage/project/ page via the input field projectDesc...

PT-2026-26643

CVE-2026-29828 DooTask v1.6.27 has a Cross-Site Scripting XSS vulnerability in the /manage/project/id page via the input field projectDesc. https://t.co/IdJyEMWfTe...

CVE-2026-29828

DooTask v1.6.27 has a Cross-Site Scripting XSS vulnerability in the /manage/project/ page via the input field projectDesc...

CVE-2026-29828

DooTask v1.6.27 , a task management tool developed by Kuaifan’s individual developers, contains a Cross-Site Scripting (XSS) vulnerability. The flaw exists in the /manage/project/ page due to the improper handling of the projectDesc input field. This vulnerability allows an attacker to execute ma...

CVE-2026-29828

DooTask v1.6.27 has a Cross-Site Scripting XSS vulnerability in the /manage/project/ page via the input field projectDesc...

DooTask security vulnerabilities

DooTask is a task management tool developed by Kuaifan’s individual developers. Version 1.6.27 of DooTask contains a security vulnerability. This vulnerability stems from improper handling of the projectDesc input field in the /manage/project/ page, which may lead to cross-site scripting attacks...