CVE-2026-111312

Received Received - Intake

OpenHealth Missing Authentication in Health Data API

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE handlers that query records by id without session or authorId checks. Unauthenticated attackers who know a HealthData record id can read another user's medical record data and file metadata, overwrite it with arbitrary JSON, or delete it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-16

AI Q&A

2026-10-16

EPSS Evaluated

N/A

NVD

CVE-2026-111312

Affected Vendors & Products

Vendor	Product	Version / Range
OpenHealthForAll	OpenHealth	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

OpenHealth through version 0.2.0 has a vulnerability where the /api/health-data/[id] endpoints for GET, PATCH, and DELETE operations do not require authentication or authorization checks. This allows unauthenticated attackers who know a valid HealthData record ID to access, modify, or delete another user's medical records and file metadata.

Detection Guidance

Check for unauthorized access to /api/health-data/[id] endpoints by monitoring HTTP GET, PATCH, and DELETE requests targeting these paths. Look for requests without valid session tokens or authorId checks. Use network traffic analysis tools like Wireshark or tcpdump to inspect traffic for suspicious patterns.

Impact Analysis

If exploited, this vulnerability could lead to unauthorized access to sensitive medical data, allowing attackers to read personal health information, overwrite records with false data, or delete critical medical files. This poses serious risks to patient privacy and data integrity.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to protected health information. GDPR requires strict data protection and user consent, while HIPAA mandates safeguards for medical records. Exploitation could result in legal penalties and loss of compliance certifications.

Mitigation Strategies

Implement authentication and authorization checks for all /api/health-data/[id] endpoints. Ensure only authorized users with valid session tokens and matching authorId can access, modify, or delete records. Update OpenHealth to the latest version if a patch is available.

Hi! I’m here to help you understand CVE-2026-111312. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70