CVE-2026-111312

EUVD-2026-102476
OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE handlers that query records by id without session or authorId checks. Unauthenticated attackers who know a HealthData record id can read another user's medical record data and file metadata, overwrite it with arbitrary JSON, or delete it.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.7 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/OpenHealthForAll/open-health
https://github.com/OpenHealthForAll/open-health/blob/v0.2.0/src/app/api/health-data/%5Bid%5D/route.ts#L13-L43
https://github.com/OpenHealthForAll/open-health/blob/v0.2.0/src/middleware.ts#L20
https://hackmd.io/@hieuPenguinnn/open-health-health-data-id-missing-auth-idor
https://www.vulncheck.com/advisories/openhealth-through-0.2.0-missing-authentication-via-api-health-data-id-route