PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-111312 OpenHealthForAll CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-10-15T21:43:28.153Z and has not been modified since then. OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE handlers that query records by id without session or authorId checks. Unauthenticated attackers who know a HealthData record id can read another user's medical record data and file metadata, overwrite it with arbitrary JSON, or delete it. Defenders responsible for OpenHealth instances, especially those with publicly accessible /api/health-data/ endpoints, should assess exposure and

Vendor
OpenHealthForAll
Product
OpenHealth
CVSS
CRITICAL 9.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-15
Original CVE updated
2026-10-15
Advisory published
2026-10-15
Advisory updated
2026-10-15

Who should care

Defenders responsible for OpenHealth instances, especially those with publicly accessible /api/health-data/ endpoints, should assess exposure and verify the effectiveness of existing authentication and authorization controls.

Why it matters

CVE-2026-111312 is a critical vulnerability in OpenHealth through 0.2.0 that allows unauthenticated attackers to access, modify, or delete sensitive medical record data. Defenders should prioritize verifying exposure and implementing proper authentication and authorization controls.

  • Unauthenticated access to sensitive medical record data
  • Potential data tampering or deletion
  • Increased risk of data breaches
  • Need for immediate verification of exposure and remediation

Technical summary

OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE handlers. Unauthenticated attackers who know a HealthData record id can read another user's medical record data and file metadata, overwrite it with arbitrary JSON, or delete it. The vulnerability allows unauthenticated attackers to access, modify, or delete sensitive medical record data. Defenders should prioritize verifying exposure of OpenHealth instances, especially those with publicly accessible /api/health-data/ endpoints, and assess the effectiveness of existing authentication and authorization controls.

Defensive priority

Defenders should prioritize verifying exposure of OpenHealth instances, especially those with publicly accessible /api/health-data/ endpoints, and assess the effectiveness of existing authentication and authorization controls.

Recommended defensive actions

  • Verify exposure of OpenHealth instances to the /api/health-data/ endpoint
  • Assess the effectiveness of existing authentication and authorization controls
  • Implement proper authentication and authorization for the /api/health-data/ endpoint
  • Monitor for suspicious activity on the /api/health-data/ endpoint
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and source item provide details on the missing authentication and authorization vulnerability in OpenHealth through 0.2.0. The vulnerability allows unauthenticated attackers to read, overwrite, or delete medical record data and file metadata by knowing a HealthData record id.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-111312 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-111312

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-111312 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-111312

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • OpenHealth through 0.2.0 Missing Authentication via /api/health-data/[id] Route

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111312.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://hackmd.io/@hieuPenguinnn/open-health-health-data-id-missing-auth-idor

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://github.com/OpenHealthForAll/open-health/blob/v0.2.0/src/app/api/health-data/%5Bid%5D/route.ts

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/OpenHealthForAll/open-health/blob/v0.2.0/src/middleware.ts

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/OpenHealthForAll/open-health

    Supplemental source - product

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/openhealth-through-0.2.0-missing-authentication-via-api-health-data-id-route

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.