Kivicare CVE-2026-25034

Although a formal CVSS vector and EPSS score are not provided, the vulnerability can be assessed through contextual signals. The CWE-862 classification (Missing Authorization) typically carries high severity due to its direct impact on confidentiality and integrity of sensitive healthcare data. The nature of the affected product (a clinic management system handling patient information) elevates real-world risk significantly, as healthcare data breaches carry regulatory, reputational, and patient safety consequences. The presence of documentation by Patchstack and assignment of an EUVD ID suggest the vulnerability has undergone independent verification and is not theoretical. Lacking definitive EPSS and KEV status, the priority should be determined by organizational deployment scope: organizations running KiviCare versions 3.6.16 or earlier should treat this as high-priority, particularly if the affected WordPress installation is internet-facing or handles sensitive patient data. The lack of publicized proof-of-concept code does not diminish the risk, as broken access control vulnerabilities are typically straightforward to discover and exploit once the control gaps are known.

An attacker with a low-privilege user account (such as a reception staff member with limited clinic access) could directly request sensitive endpoints or resources belonging to higher-privilege roles (such as patient records or billing data belonging to other departments) without proper authorization checks. Alternatively, an unauthenticated attacker could potentially discover that certain administrative functions lack sufficient access controls, allowing direct manipulation of clinic settings or patient information without any valid user credentials. Because access control flaws are typically non-complex to exploit once discovered (requiring only knowledge of the affected URLs or API endpoints and standard HTTP requests), the barrier to exploitation is low.