Openhealth
Monthly
OpenHealth through 0.2.0 fails to enforce authentication or ownership checks in the /api/health-data/[id] GET, PATCH, and DELETE handlers, allowing unauthenticated attackers who know a HealthData record id to read another user's medical record data and file metadata, overwrite the record with arbitrary JSON, or delete it. The issue is rated CVSS 4.0 9.2 and is reported by VulnCheck; no public exploit identified at time of analysis, and no CISA KEV active-exploitation confirmation is provided. Exploitation still depends on obtaining a valid record id: if ids are sequential or otherwise enumerable, the impact scales to mass medical-record theft or tampering, while high-entropy UUIDs narrow exploitation to targeted abuse after an id leak.
OpenHealth through 0.2.0 fails to enforce authentication or ownership checks in the /api/health-data/[id] GET, PATCH, and DELETE handlers, allowing unauthenticated attackers who know a HealthData record id to read another user's medical record data and file metadata, overwrite the record with arbitrary JSON, or delete it. The issue is rated CVSS 4.0 9.2 and is reported by VulnCheck; no public exploit identified at time of analysis, and no CISA KEV active-exploitation confirmation is provided. Exploitation still depends on obtaining a valid record id: if ids are sequential or otherwise enumerable, the impact scales to mass medical-record theft or tampering, while high-entropy UUIDs narrow exploitation to targeted abuse after an id leak.