CVE-2026-13381

Received Received - Intake

Insecure Direct Object Reference in VSee Clinic 7.1.26

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: Security Risk Advisors

Description

VSee Clinic 7.1.26 and API 1.3.0 contain an Insecure Direct Object Reference (IDOR) vulnerability in the /v1.3.0/api/files endpoint. An authenticated attacker can manipulate the 'remark' request parameter to enumerate, retrieve, and delete files belonging to other users on the application server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-20

Last Modified

2026-07-20

Generated

2026-07-21

AI Q&A

2026-07-21

EPSS Evaluated

N/A

NVD

CVE-2026-13381

Affected Vendors & Products

Vendor	Product	Version / Range
vsee	clinic	7.1.26
vsee	api	1.3.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in VSee Clinic 7.1.26 and API 1.3.0. An authenticated attacker can manipulate the 'remark' request parameter in the /v1.3.0/api/files endpoint to access, retrieve, or delete files belonging to other users on the server.

Detection Guidance

To detect this IDOR vulnerability in VSee Clinic 7.1.26 or API 1.3.0, monitor network traffic for requests to the /v1.3.0/api/files endpoint. Look for authenticated requests with manipulated 'remark' parameters attempting to access or delete files not belonging to the user. Check server logs for unusual file access patterns or deletions.

Impact Analysis

An attacker could gain unauthorized access to sensitive files, leading to data breaches, loss of confidential information, or disruption of services. Users' private data may be exposed or deleted without their consent.

Compliance Impact

This vulnerability could lead to violations of GDPR (data protection) and HIPAA (healthcare privacy) by exposing or mishandling sensitive personal or medical data, resulting in legal penalties and loss of trust.

Mitigation Strategies

Immediately update VSee Clinic to the latest version beyond 7.1.26 and API to 1.3.0 or higher. Implement strict input validation for the 'remark' parameter to prevent manipulation. Restrict file access permissions to enforce user-level isolation. Disable the /v1.3.0/api/files endpoint if not essential.

Hi! I’m here to help you understand CVE-2026-13381. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70