Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.2

OpenHealth lets anyone read, change or delete health records

CVE-2026-111312 · published today
Summary

The OpenHealth software (versions up to 0.2.0) does not check who is making requests to its health-data API, so anyone who knows a record’s ID can view, modify or delete another person’s medical information. This can expose private health data and allow unauthorized changes. Upgrade to a version that adds proper login and permission checks, or apply a patch that enforces authentication for those endpoints.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
openhealthforall openhealth <= 0.2.0
Original advisory text
OpenHealth through 0.2.0 Missing Authentication via /api/health-data/[id] Route
OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE handlers that query records by id without session or authorId checks. Unauthenticated attackers who know a HealthData record id can read another user's medical record data and file metadata, overwrite it with arbitrary JSON, or delete it.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
9.2 Critical
Type
CWE-306Missing Authentication for Critical Function
Timeline
Published15 Oct 2026
Updated15 Oct 2026
First seen15 Oct 2026
Sources
CVE-2026-111312 · NVD
CVE-2026-111312 · MITRE
Track software like this
Free during beta