CVE-2026-13381

Name of the Vulnerable Software and Affected Versions VSee Clinic version 7.1.26 VSee API version 1.3.0

Description An Insecure Direct Object Reference (IDOR) occurs in the '/v1.3.0/api/files' endpoint. An authenticated attacker can manipulate the remark request parameter to enumerate, retrieve, and delete files belonging to other users on the application server. IDOR is a type of access control flaw where an application provides direct access to objects based on user-supplied input.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the remark parameter in the '/v1.3.0/api/files' endpoint until the issue is resolved.