Description
OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE handlers that query records by id without session or authorId checks. Unauthenticated attackers who know a HealthData record id can read another user's medical record data and file metadata, overwrite it with arbitrary JSON, or delete it.
References
- www.cve.org/CVERecord ↗
- nvd.nist.gov/vuln/detail/CVE-2026-111312 ↗
- github.com/OpenHealthForAll/open-health ↗
- github.com/OpenHealthForAll/open-health/blob/v0.2.0/src/app/api/health-data/%5Bid%5D/route.ts ↗
- github.com/OpenHealthForAll/open-health/blob/v0.2.0/src/middleware.ts ↗
- hackmd.io/@hieuPenguinnn/open-health-health-data-id-missing-auth-idor ↗
- www.vulncheck.com/advisories/openhealth-through-0.2.0-missing-authentication-via-api-health-data-id-route ↗
Related CVEs
← CVE Index: search every CVE from the last 30 days
This product uses the NVD API but is not endorsed or certified by the NVD. CVSS scores do not establish exploitation.