Which versions of VSee Clinic are affected by EUVD-2026-46093?

VSee Clinic 7.1.26 (API 1.3.0) contains an authentication bypass flaw in file access controls that exposes all patient records and medical documents to unauthorized access and deletion by any basic…. A patch is available.

How to fix or mitigate EUVD-2026-46093?

Within 24 hours, conduct an inventory of all VSee Clinic 7.1.26 deployments, identify affected user counts, and enable detailed API access logging on the /v1.3.0/api/files endpoint with alerting for cross-user file access attempts. Within 7 days, implement application-level authorization enforcement to restrict file operations to file owners only, deploy Web Application Firewall rules blocking direct object reference patterns on the endpoint, and conduct forensic audit of file access logs for signs of unauthorized activity. Within 30 days, contact VSee vendor to confirm patch availability and release timeline; if remediation exceeds 30 days, prepare breach risk assessment and patient notification procedures, and evaluate switching to alternative telehealth platforms with stronger API access controls.

VSee Clinic EUVD-2026-46093

Q: What is the CVSS score of EUVD-2026-46093?

EUVD-2026-46093 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-13381 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-20 SRA

GHSA-5xwg-q2hm-f263

Authentication Bypass Clinic

8.7

CVSS 4.0 · Vendor: SRA

Severity by source

Vendor (SRA) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable API with low complexity needs only a single low-privileged account (PR:L); IDOR yields full read of others' files (C:H) plus deletion (I:H/A:H), scope unchanged.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (SRA).

CVSS VectorVendor: SRA

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 20, 2026 - 23:18 EUVD

Analysis Generated

Jul 20, 2026 - 20:46 vuln.today

CVE Published

Jul 20, 2026 - 20:12 cve.org

HIGH 8.7

DescriptionCVE.org

VSee Clinic 7.1.26 and API 1.3.0 contain an Insecure Direct Object Reference (IDOR) vulnerability in the /v1.3.0/api/files endpoint. An authenticated attacker can manipulate the 'remark' request parameter to enumerate, retrieve, and delete files belonging to other users on the application server.

AnalysisAI

Insecure Direct Object Reference in VSee Clinic 7.1.26 (API 1.3.0) lets an authenticated user tamper with the 'remark' parameter on the /v1.3.0/api/files endpoint to enumerate, download, and delete files owned by other users of the telehealth platform. Because a single low-privileged account yields full read and destructive access to every user's files, the flaw combines confidentiality with integrity and availability loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the technique is trivial and self-evident from the SRA Labs disclosure.

Technical ContextAI

VSee Clinic is a HIPAA-oriented telemedicine/telehealth platform whose backend REST API (v1.3.0) exposes a file-management endpoint at /v1.3.0/api/files. The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key): the 'remark' request parameter is used as a direct reference to stored file objects, and the server performs the file operation based on that client-supplied key without verifying that the authenticated caller actually owns the referenced file. This missing object-level authorization (a broken-object-level-authorization / BOLA pattern common to REST APIs) means the identifier space can be walked to reach arbitrary tenants' files. In a clinical context these files are likely to include patient documents, images, and visit attachments, raising the practical sensitivity well beyond a generic file store.

RemediationAI

No vendor-released patch identified at time of analysis, so operators should contact VSee directly, monitor https://vsee.com/clinic, and reference the SRA Labs advisory at https://labs.sra.io/posts/vseeclinic for coordinated disclosure and fix details before upgrading to any vendor-supplied build above 7.1.26 / API 1.3.0. As compensating controls until a fix is available: enforce server-side object-level authorization so the API validates that the authenticated session owns the file referenced by the 'remark' parameter (the correct root-cause fix); if code changes are not possible, restrict or proxy the /v1.3.0/api/files endpoint behind an API gateway or WAF rule that rejects requests where 'remark' does not correspond to the caller's identity, accepting that this is brittle and may break legitimate file access; and tighten account provisioning while monitoring the endpoint for sequential or high-volume 'remark' enumeration, understanding that this only detects rather than prevents abuse. Disabling file upload/download features entirely would eliminate exposure but likely breaks core clinical workflows.