Insecure Direct Object Reference in VSee Clinic File API (CVE-2026-13381)

VSee Clinic 7.1.26 and API 1.3.0 contain an Insecure Direct Object Reference (IDOR) vulnerability in the /v1.3.0/api/files endpoint. An authenticated attacker can manipulate the 'remark' request parameter to enumerate, retrieve, and delete files belonging to other users on the application server. This vulnerability has a CVSS base score of 8.7 (High). Affected versions: - VSee Clinic 7.1.26 - VSee Clinic API 1.3.0 We recommend updating to: VSee Clinic 7.1.26.1, VSee Clinic API 1.3.0.1. CVSS 8.7 · our assessment: this_week Reference: https://labs.sra.io/posts/vseeclinic Details: https://vuln.today/cve/CVE-2026-13381