PT-2026-57345

CVE-2026-59979

Published

2026-07-10

Updated

2026-10-28

Description by

CVSS 3.1

8.3

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions YosemiteCrew (affected versions not specified)

Description An Insecure Direct Object Reference (IDOR) exists where service and PMS task-library/template routes omit organization and permission checks. The authorizeCognito function in apps/backend/src/middlewares/auth.ts sets the authenticated user's ID but fails to implement withOrgPermissions() and requirePermission(...) checks. Consequently, any registered user, including those with patient or companion-app accounts, can modify or delete service catalogues and PMS task-library/template data belonging to other organizations, which impacts bookings and billing. Additionally, service records can be read without any authentication. The issue occurs because the ServiceModel.findById(oid) function in apps/backend/src/services/service.service.ts is called without an organisationId filter. Affected endpoints include:

GET /fhir/v1/service/:id (no authentication)
PATCH /fhir/v1/service/:id (authentication only)
DELETE /fhir/v1/service/:id (authentication only)
PUT /v1/task/pms/library/:libraryId (no organization/role enforcement)
POST /v1/task/pms/templates (no organization/role enforcement)
PATCH /v1/task/pms/templates/:templateId (no organization/role enforcement)
DELETE /v1/task/pms/templates/:templateId (no organization/role enforcement)