DooTask Missing Authorization in WebSocketDialog

Executive Summary

CVE-2026-111640 is a missing authorization vulnerability in DooTask versions up to 1.9.66. The WebSocketDialog::checkDialog() function fails to verify membership for OKR comment dialogs, allowing authenticated users to access these dialogs by providing a dialog_id to endpoints like msg__list, msg__one, or msg__send*. Users can then read existing messages or inject new ones into private OKR discussions they are not part of.

The flaw occurs because the code has a special branch for OKR dialogs that skips the standard membership check applied to other dialog types. This bypasses intended access controls, enabling unauthorized data exposure and manipulation.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized access to OKR comment dialogs by monitoring WebSocket traffic or application logs for requests to msg__list, msg__one, or msg__send* endpoints with dialog_id parameters. Look for unusual message injections or reads in OKR discussions.

Useful 0 Not Useful 0

Impact Analysis

If you use DooTask 1.9.66 or earlier, an attacker with valid credentials could access private OKR discussions by guessing or obtaining dialog IDs. They may read sensitive project goals, key results, or internal communications. Attackers could also inject misleading or malicious messages into these discussions, potentially disrupting workflows or spreading misinformation.

Since OKR dialogs are meant to be private to specific teams, this vulnerability could lead to unauthorized access to strategic planning information, affecting decision-making processes and organizational transparency.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive project data, which may include personal or confidential information. For GDPR, this could result in violations of data protection principles if personal data is exposed without authorization. For HIPAA, if the application handles protected health information within OKR discussions, unauthorized access could breach compliance requirements.

Organizations using DooTask for regulated data must address this vulnerability to avoid potential fines, legal liabilities, and reputational damage associated with non-compliance with data protection regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade DooTask to a patched version beyond 1.9.66. If unavailable, apply a temporary fix by modifying WebSocketDialog.php to enforce membership checks for OKR dialogs. Restrict access to sensitive dialogs and review logs for suspicious activity.

Useful 0 Not Useful 0