CVE-2026-111312
OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the…
- Risk score
- 59/100
- CVSS
- 7.7 v3.1
- Exploit chance (30 days)
- 0.5%
- Published
- 15 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE handlers that query records by id without session or authorId checks. Unauthenticated attackers who know a HealthData record id can read another user's medical record data and f…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.7 high
- Remotely exploitable without logging in
References
- https://github.com/OpenHealthForAll/open-health
- https://github.com/OpenHealthForAll/open-health/blob/v0.2.0/src/app/api/health-data/%5Bid%5D/route.ts#L13-L43
- https://github.com/OpenHealthForAll/open-health/blob/v0.2.0/src/middleware.ts#L20
- https://hackmd.io/@hieuPenguinnn/open-health-health-data-id-missing-auth-idor
- https://www.vulncheck.com/advisories/openhealth-through-0.2.0-missing-authentication-via-api-health-data-id-route
Original description
OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE handlers that query records by id without session or authorId checks. Unauthenticated attackers who know a HealthData record id can read another user's medical record data and file metadata, overwrite it with arbitrary JSON, or delete it.
Last activity 15 Oct 2026. Patch Forecast updates every hour.