CVE Intelligence

OpenHealthForAll vulnerabilities

🔔 Create alert RSS

Published CVEs affecting OpenHealthForAll products: 1 record(s), with severity, exploitation and fixes.

OpenHealth 1

Exploited only (KEV) →

CVE-2026-111312 High · 7.7 CWE-306 Oct 15, 2026
OpenHealth through 0.2.0 Missing Authentication via /api/health-data/[id] Route
OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE handlers that query records by id without session or authorId checks. Unauthenticated attackers who know a HealthData record id can read another user's medical record data and file metadata, overwrite it with arbitrary JSON, or delete it.