CVE-2026-47672 Details

A vulnerability in the oviva epa4all-client Java application, specifically in versions through 1.2.4, allows any network-reachable caller to write arbitrary documents to patients' electronic health records. This issue is accessible via the institution's SMC-B card. In misconfigured deployments, such as those following the production Docker example, the vulnerability can be exploited from the local network without credentials.

No patched version is available. As a workaround, network policies or proxies can be used to enforce service-to-service authentication, such as mutual TLS. The service can also be run in an isolated network namespace, for example as a Kubernetes sidecar, or within a service mesh that applies the appropriate policies.