EUVD-2026-36681
GHSA-m3f2-gxh3-v237
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible REST API requires an authenticated low-privilege account; read-only IDOR yields confidentiality impact only, with no integrity or availability consequence.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in medkey-org medkey up to fc09b7ba9441ff590b72d428d5380834216b09ed. Impacted is the function actionGetPatientById of the file app\modules\medical\port\rest\controllers\PatientController.php of the component HTTP REST API. The manipulation of the argument ID results in improper control of resource identifiers. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Patient record exposure in medkey EHR (up to commit fc09b7ba9441ff590b72d428d5380834216b09ed) allows authenticated remote users to retrieve arbitrary patient records by manipulating the id parameter of the actionGetPatientById REST API endpoint - a textbook Insecure Direct Object Reference (BOLA/IDOR) flaw classified under CWE-99. A publicly available proof-of-concept exploit is hosted on GitHub (onyxglitch/Medkey-EHR-IDOR-PoC), materially lowering the exploitation barrier. The vendor did not respond to coordinated disclosure, leaving no confirmed patch and no official advisory for this rolling-release EHR system.
Technical ContextAI
Medkey is a PHP-based Electronic Health Record (EHR) platform structured as a modular REST API application. The vulnerable component is the function actionGetPatientById located at app\modules\medical\port\rest\controllers\PatientController.php, which handles HTTP GET requests to retrieve patient data by a caller-supplied id parameter. CWE-99 (Improper Control of Resource Identifiers) identifies the root cause: the application accepts a user-controlled identifier and resolves it to a backend resource without verifying that the authenticated requester is authorized to access the record belonging to that specific ID. This is a Broken Object Level Authorization (BOLA) failure - the API trusts the client-supplied ID rather than enforcing ownership or role-based access at the object level. The CPE string cpe:2.3:a:medkey-org:medkey:*:*:*:*:*:*:*:* covers all versions of the product with no lower or upper bound, consistent with the rolling-release model described in the disclosure.
RemediationAI
No vendor-released patch identified at time of analysis - the vendor did not respond to coordinated disclosure and no fixed commit or release has been confirmed. Organizations running medkey should immediately apply the following compensating controls while pursuing an upstream fix or evaluating alternative platforms. First, restrict network access to the REST API endpoint to only trusted internal networks or VPN-authenticated sessions, reducing the attack surface to internal users; this does not fix the authorization flaw but limits exposure. Second, implement API gateway or WAF rules to enforce rate limiting and detect sequential integer enumeration of the patient id parameter, which can identify exploitation attempts; note this adds detection but not prevention. Third, audit existing application access logs for abnormal patterns of actionGetPatientById calls across multiple distinct patient IDs from a single authenticated session, which may indicate prior or ongoing exploitation. Fourth, review and enforce application-level role-based access controls at the framework layer so that patient record retrieval is gated on a confirmed care relationship, not just authentication. The VulDB advisory at https://vuldb.com/vuln/370849 should be monitored for any vendor response or patch publication.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today