CVE-2026-111312

Name of the Vulnerable Software and Affected Versions OpenHealth versions prior to 0.2.1

Description Missing authentication and authorization in the '/api/health-data/[id]' GET, PATCH, and DELETE handlers allow unauthenticated attackers to access medical records. By knowing a HealthData record id, an attacker can read another user's medical record data and file metadata, overwrite it with arbitrary JSON, or delete the record. This occurs because the system queries records by id without performing session or authorId checks.

Recommendations Update OpenHealth to version 0.2.1 or later. As a temporary workaround, restrict access to the '/api/health-data/[id]' endpoint to minimize the risk of exploitation.