OpenHealth: Missing authentication in health data API

Summary

OpenHealth through version 0.2.0 exposes the /api/health-data/[id] endpoints for GET, PATCH and DELETE without session or ownership checks. An unauthenticated attacker who knows a health record ID can read another user's medical record data and file metadata, overwrite it with arbitrary JSON, or delete it. The CNA rates this as critical (CVSS 4.0 9.2), while another scoring source gives a lower value, and the exposure depends on whether an instance is reachable from untrusted networks.

Affected

• OpenHealthForAll OpenHealth, versions 0 to 0.2.0 (inclusive)
• Endpoints: /api/health-data/[id] (GET, PATCH, DELETE)

Fixed in

Unknown.

Workaround

• Do not expose the instance directly to the internet; place it behind a VPN or an authenticating reverse proxy, or restrict access to known networks.
• Back up the database before making any changes.
• Removing or restricting the affected endpoints requires a code change that must be validated by the operator.

Exploitation

• No evidence of exploitation in the wild found; the CVE is not listed in CISA KEV.
• A public write-up exists; CISA SSVC rates exploitation as PoC and automatable as no.

Our recommendation

• Check whether any OpenHealth instance is reachable from the internet and take it offline or restrict access now.
• Review web server or application logs for unexpected GET, PATCH or DELETE requests to /api/health-data/ from unknown sources.
• If compromise cannot be ruled out, involve legal or compliance staff to assess notification duties under the Swiss revised FADP.
• Monitor the upstream repository for a fixed release and apply it once available.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• VulnCheck advisory www.vulncheck.com
• Vulnerable route.ts at v0.2.0 github.com
• HackMD write-up hackmd.io
• OpenHealth GitHub repository github.com
• OSV entry osv.dev
• OpenCVE entry app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:22.