CVE-2026-105667: J4Care dcm4che Missing Authentication for Critical Function
In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another. The archive's unmerge does not reverse this.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
J4Care dcm4cheto a version that resolves this vulnerability.Fixed in 5.35.2
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using the default configuration are exposed because the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application.
What does an attacker need to exploit this issue?
An attacker needs network access to send an ADT^A40 patient-merge message to the HL7 listener. No authentication or user interaction is required.
What is the practical impact of a successful attack?
A remote sender can reassign studies and related workflow records from one patient identity to another, compromising record integrity.
Can the archive unmerge operation undo the impact?
No. The archive's unmerge does not reverse the reassignment caused by the patient-merge message.