CVE-2026-97851: J4Care dcm4che Missing Authorization
The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states. Changing a location to TODELETE causes PurgeStorageScheduler to delete the referenced object from storage even though the corresponding instance record remains in the database.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
J4Care dcm4cheto a version that resolves this vulnerability.Fixed in 5.35.2
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The issue is reachable through the storage status-change REST service, and the supplied vector indicates network access, no privileges, and no user interaction are required.
What is the operational impact if exploitation succeeds?
An attacker can change a location record to TO_DELETE. PurgeStorageScheduler can then delete the referenced DICOM object from storage while its instance record remains in the database, creating a mismatch between database records and stored objects.
How can defenders identify whether exploitation may have occurred?
Look for location records changed to deletion-related states, particularly TO_DELETE, where the associated DICOM instance record still exists in the database but the referenced object is absent from storage.