CVE-2026-111312: OpenHealth through 0.2.0 Missing Authentication via /api/health-data/[id] Route
OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE handlers that query records by id without session or authorId checks. Unauthenticated attackers who know a HealthData record id can read another user's medical record data and file metadata, overwrite it with arbitrary JSON, or delete it.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Any deployment of OpenHealth through 0.2.0 that exposes the affected health-data API route is exposed. The affected GET, PATCH, and DELETE handlers do not enforce session authentication or verify that the requester owns the record.
What does an attacker need to exploit it?
An attacker does not need an account or user interaction. They need to know a HealthData record ID to target the unauthenticated endpoint.
What can an attacker do with a targeted record ID?
They can read another user's medical record data and file metadata, overwrite the record with arbitrary JSON, or delete it. The available impact depends on whether they use the GET, PATCH, or DELETE handler.