What is the CVSS score of CVE-2026-47672?

CVE-2026-47672 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

epa4all-client CVE-2026-47672

EUVD-2026-31998 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-05-26 security-advisories@github.com

GHSA-c82x-f4xr-qv33

Authentication Bypass Java Docker

6.5

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

6.5 MEDIUM

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from Vendor (github) · only source for this CVE.

CVSS VectorVendor: github

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

May 26, 2026 - 21:36 vuln.today

Analysis Generated

May 26, 2026 - 21:36 vuln.today

DescriptionCVE.org

epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. In 1.2.4 and earlier, any network-reachable caller can write arbitrary documents to any patient's electronic health record accessible by the institution's SMC-B card. In a misconfigured deployment (e.g., following the production Docker example in the README), this is exploitable from the local network without credentials.

AnalysisAI

Unauthenticated write access to patient electronic health records in epa4all-client 1.2.4 and earlier exposes German Telematik Infrastruktur (ePA 3.0) deployments to unauthorized data manipulation. The REST adapter component ships with no authentication or authorization controls, allowing any adjacent-network caller to write arbitrary documents to any patient EHR accessible via the institution's SMC-B card. No public exploit code has been identified at time of analysis, but the CVSS vector (AV:A/AC:L/PR:N/UI:N) confirms exploitation requires no credentials and minimal technical complexity once network-adjacent.

Technical ContextAI

epa4all-client is a Java-based REST adapter that interfaces with the German ePA 3.0 electronic patient record infrastructure (Telematik Infrastruktur). It authenticates to the ePA backend using an institutional SMC-B smart card, then exposes a local REST API for internal callers to read and write patient documents. CWE-306 (Missing Authentication for Critical Function) identifies the root cause: this internal REST API has no authentication or authorization layer of its own, so any process or host that can reach it over the network can invoke its full write capabilities on behalf of the card-holding institution. The production Docker example in the README inadvertently exposed this adapter to the local network segment. The GitHub PR #43 fix is exclusively documentation - caution notes added to README.md warning operators to deploy behind a reverse proxy or as a Kubernetes sidecar - meaning the REST adapter still ships without built-in authentication.

RemediationAI

No vendor-released patched version has been independently confirmed - the upstream fix in PR #43 (https://github.com/oviva-ag/epa4all-client/pull/43) consists solely of documentation changes adding caution warnings; it does not implement authentication in the REST adapter code. Operators must implement compensating controls immediately. The most effective mitigation is to place the REST adapter behind a reverse proxy (e.g., nginx, Traefik) configured with authentication and strict IP allowlisting, restricting access to only the expected internal callers. Alternatively, deploy the adapter as a Kubernetes sidecar container, making it accessible only within the pod's localhost network and not via the broader cluster or host network. Do not expose the REST adapter port (default bound interface) on any network interface reachable by untrusted hosts. Review existing Docker Compose and deployment configurations to verify the adapter port is not published externally. Consult the GitHub advisory at https://github.com/oviva-ag/epa4all-client/security/advisories/GHSA-c82x-f4xr-qv33 for operator guidance.