Any network-reachable caller can write arbitrary documents to any patient's electronic health record accessible by the institution's SMC-B card. In a misconfigured deployment (e.g., following the production Docker example in the README), this is exploitable from the local network without credentials.

Use network policies or proxies to enforce service-to-service authentication via e.g. mTLS.

Machine Spirits (contact@machinespirits.de)