Clinic
Monthly
Insecure Direct Object Reference in VSee Clinic 7.1.26 (API 1.3.0) lets an authenticated user tamper with the 'remark' parameter on the /v1.3.0/api/files endpoint to enumerate, download, and delete files owned by other users of the telehealth platform. Because a single low-privileged account yields full read and destructive access to every user's files, the flaw combines confidentiality with integrity and availability loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the technique is trivial and self-evident from the SRA Labs disclosure.
Cleartext SFTP credential disclosure in VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 allows any unauthenticated remote attacker to harvest working SFTP logins by simply reading the HTTP responses of three exposed endpoints. The credentials appear whenever SFTP integration has been configured in the application, giving the attacker direct access to the backing SFTP server and whatever clinical or file data it holds. No public exploit or CISA KEV listing exists at time of analysis, but with a 9.0 CVSS and zero authentication required, exploitation is trivial once the endpoints are located.
Insecure Direct Object Reference in VSee Clinic 7.1.26 (API 1.3.0) lets an authenticated user tamper with the 'remark' parameter on the /v1.3.0/api/files endpoint to enumerate, download, and delete files owned by other users of the telehealth platform. Because a single low-privileged account yields full read and destructive access to every user's files, the flaw combines confidentiality with integrity and availability loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the technique is trivial and self-evident from the SRA Labs disclosure.
Cleartext SFTP credential disclosure in VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 allows any unauthenticated remote attacker to harvest working SFTP logins by simply reading the HTTP responses of three exposed endpoints. The credentials appear whenever SFTP integration has been configured in the application, giving the attacker direct access to the backing SFTP server and whatever clinical or file data it holds. No public exploit or CISA KEV listing exists at time of analysis, but with a 9.0 CVSS and zero authentication required, exploitation is trivial once the endpoints are located.