CVE-2026-13381 VSee CVE debrief

Who should care

Users of VSee Clinic 7.1.26 and API 1.3.0 should be aware of this vulnerability and take steps to mitigate it. This includes administrators and security teams responsible for managing and securing the affected systems, as well as operators who may be impacted by the potential unauthorized access to sensitive files. Additionally, vulnerability management teams should prioritize patching or mitigating this vulnerability to prevent potential data breaches or service disruptions. Security teams should also monitor for suspicious file access and manipulation attempts to detect potential exploitation attempts.

Technical summary

CVE-2026-13381 is an Insecure Direct Object Reference (IDOR) vulnerability in VSee Clinic 7.1.26 and API 1.3.0. An authenticated attacker can manipulate the 'remark' request parameter to enumerate, retrieve, and delete files belonging to other users. This vulnerability allows attackers to access and manipulate sensitive files without proper authorization, potentially leading to data breaches or service disruptions. The vulnerability is considered High severity with a CVSS score of 8.7.

Defensive priority

Authenticated attackers can exploit this vulnerability to manipulate files belonging to other users.

Recommended defensive actions

• Inventory and verify VSee Clinic and API versions.
• Restrict access to the /v1.3.0/api/files endpoint.
• Implement proper authorization checks for file access and manipulation.
• Monitor for suspicious file access and manipulation attempts.
• Apply vendor patches or updates when available.

Evidence notes

The CVE-2026-13381 record indicates VSee Clinic 7.1.26 and API 1.3.0 are vulnerable to an Insecure Direct Object Reference (IDOR) issue. Limited information is available about the specific impacts and affected configurations. To verify and assess exposure, defenders should review the official CVE record, check for vendor patches or updates, and monitor for suspicious file access and manipulation attempts. The vulnerability allows an authenticated attacker to manipulate the 'remark' request parameter to enumerate, retrieve, and delete files belonging to other users on the application server. However, detailed information about the vulnerability's impact on specific configurations and potential mitigations is limited.

Official resources