PT-2026-115626 · J4Care · Dcm4Chee-Arc-Light
CVE-2026-97851
·
Published
2026-10-16
·
Updated
2026-10-16
CVSS v3.1
9.1
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states. Changing a location to TO DELETE causes PurgeStorageScheduler to delete the referenced object from storage even though the corresponding instance record remains in the database.
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Dcm4Chee-Arc-Light