OpenHealthForAll CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

CRITICAL OpenHealthForAll CVE published 2026-10-15

CVE-2026-111312

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-10-15T21:43:28.153Z and has not been modified since then. OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE handlers that query records by id without session or authorId checks. Unauthenticated attackers who kno [truncated]