Yosemite Crew
Monthly
Cross-tenant IDOR and missing function-level authorization in YosemiteCrew allow any registered platform user - down to a self-registrable patient or companion-app account - to modify or delete another organization's FHIR service catalogue and PMS task-library/template definitions, with service records additionally readable with no authentication at all. The exposed routes (PATCH and DELETE on /fhir/v1/service/:id, PUT on /v1/task/pms/library/:libraryId, and the PMS template create, update and delete routes) carry only authorizeCognito, while sibling create routes already enforce withOrgPermissions() and requirePermission(...), and the service layer resolves records by global ID without an organisationId filter. Vendor-released patch: none identified at time of analysis - the issue is confirmed at main/dev commit bc1a1824b1a7eba2bc61176cdb61d9a2a11bce57 with no fix queued, and no public exploit code was identified at time of analysis.
Cross-tenant IDOR and missing function-level authorization in YosemiteCrew allow any registered platform user - down to a self-registrable patient or companion-app account - to modify or delete another organization's FHIR service catalogue and PMS task-library/template definitions, with service records additionally readable with no authentication at all. The exposed routes (PATCH and DELETE on /fhir/v1/service/:id, PUT on /v1/task/pms/library/:libraryId, and the PMS template create, update and delete routes) carry only authorizeCognito, while sibling create routes already enforce withOrgPermissions() and requirePermission(...), and the service layer resolves records by global ID without an organisationId filter. Vendor-released patch: none identified at time of analysis - the issue is confirmed at main/dev commit bc1a1824b1a7eba2bc61176cdb61d9a2a11bce57 with no fix queued, and no public exploit code was identified at time of analysis.