CVE-2026-111312 Details
Description
OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE handlers that query records by id without session or authorId checks. Unauthenticated attackers who know a HealthData record id can read another user's medical record data and file metadata, overwrite it with arbitrary JSON, or delete it.
A vulnerability exists in OpenHealth versions through 0.2.0, allowing unauthenticated access to the health data API. The issue is present in the GET, PATCH, and DELETE handlers of the /api/health-data/[id] route, which manage health records based solely on the record ID without verifying the user's session or ownership. This flaw enables unauthorized users to read, modify, or delete another user's medical records and associated metadata.
Add authentication and authorization checks to the GET, PATCH, and DELETE handlers in the health data API. Ensure that each handler verifies the user's session and restricts access to only the owner's records. Additionally, update the application middleware to enforce authentication for all API routes.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackmd.io/@hieuPenguinnn/open-health-health-data-id-missing-auth-idor | CISA-ADP | ExploitTechnical Analysis |
| https://github.com/OpenHealthForAll/open-health | [email protected] | ProductSource CodeVendor |
| https://github.com/OpenHealthForAll/open-health/blob/v0.2.0/src/app/api/health-data/%5Bid%5D/route.ts#L13-L43 | [email protected] | Source CodeVendor |
| https://github.com/OpenHealthForAll/open-health/blob/v0.2.0/src/middleware.ts#L20 | [email protected] | Source CodeVendor |
| https://hackmd.io/@hieuPenguinnn/open-health-health-data-id-missing-auth-idor | [email protected] | ExploitTechnical Analysis |
| https://www.vulncheck.com/advisories/openhealth-through-0.2.0-missing-authentication-via-api-health-data-id-route | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OpenHealth | <= 0.2.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 23, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |