by Kastro
Paper/Archive/CVE-2026-111312

CVE-2026-111312

OpenHealthForAll OpenHealth — OpenHealth through 0.2.0 Missing Authentication via /api/health-data/[id] Route

EPSS 0.6%public exploitCVSS 9.2
critical.is priorityof 100
47
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 48.1.481 × 209.6Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE handlers that query records by id without session or authorId checks. Unauthenticated attackers who know a HealthData record id can read another user's medical record data and file metadata, overwrite it with arbitrary JSON, or delete it.

Affected

ProductAffectedFixed inSource
OpenHealth≤ 0.2.0–CNA

Scores by source

VulnCheck (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
VulnCheck (CNA)7.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploithackmd.io/@hieuPenguinnn/open-health-health-data-id-missing-auth-idorwriteupgithub.com/OpenHealthForAll/open-health/blob/v0.2.0/src/app/api/health-data/%5Bid%5D/route.ts#L13-L43writeupgithub.com/OpenHealthForAll/open-health/blob/v0.2.0/src/middleware.ts#L20refgithub.com/OpenHealthForAll/open-healthwriteupvulncheck.com/advisories/openhealth-through-0.2.0-missing-authentication-via-api-health-data-id-route