YosemiteCrew Yosemite-Crew: Missing authorization on service and PMS task routes
Summary
Several service and PMS task-library/template API routes in YosemiteCrew check only that the caller is logged in, and do not verify organisation membership or permissions. Service lookups by record ID also do not filter by organisation, and the GET route for a single service has no authentication at all. Any registered platform user, including a patient or companion-app account, can modify or delete another organisation's service catalogue and task templates, affecting bookings and billing, and unauthenticated users can read service records.
Affected
- Yosemite-Crew (main and dev snapshots) up to commit bc1a1824b1a7eba2bc61176cdb61d9a2a11bce57
- Affected routes: PATCH and DELETE /fhir/v1/service/:id, GET /fhir/v1/service/:id (no authentication), PUT /v1/task/pms/library/:libraryId, POST /v1/task/pms/templates, PATCH and DELETE /v1/task/pms/templates/:templateId
- Release range: Unknown.
Fixed in
Unknown. No fixed release or commit has been identified.
Workaround
No vendor workaround published.
- Do not expose the backend API to the internet; restrict it to the clinic network or VPN, or place it behind an access gateway.
- Restrict or disable open self-registration until a fix is available.
Exploitation
- Not known to be exploited in the wild; not listed in CISA KEV.
- Technical details are reported as known; sources differ on whether public exploit code exists.
- Attack requires a registered account for write routes; the GET route requires no account.
Our recommendation
- Check whether Yosemite-Crew is deployed and whether its backend is reachable from the internet.
- Restrict backend access to the clinic network or VPN, especially the unauthenticated GET route.
- Review service catalogue, task-library and template data for unexpected changes or deletions, and back up billing-relevant configuration.
- Review API logs for PATCH, PUT and DELETE calls from accounts outside the owning organisation.
- Monitor the vendor advisory for a fixed release and apply it as soon as it is available.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-256m-gg99-4274 github.com
- Vulners CIRCL record CVE-2026-59979 vulners.com
- VulDB entry 428019 vuldb.com
- CVE Threat Intelligence record cve.threatint.com
- Strix CVE record www.strix.ai
- TheHackerWire CVE-2026-59979 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:07.
Original description (NVD)
YosemiteCrew provides organization-based service and task management. In the source-reported affected main and dev snapshots, YosemiteCrew's service and PMS task-library/template routes omit organization and permission checks. `authorizeCognito` in `apps/backend/src/middlewares/auth.ts` sets the authenticated user's ID but does not provide the `withOrgPermissions()` and `requirePermission(...)` checks used by protected siblings. In `apps/backend/src/routers/service.router.ts`, `PATCH /fhir/v1/service/:id` and `DELETE /fhir/v1/service/:id` are authentication-only, while `GET /fhir/v1/service/:id` has no authentication middleware. The trace through `apps/backend/src/controllers/web/service.controller.ts` to `apps/backend/src/services/service.service.ts` passes a global record ID into `ServiceModel.findById(oid)` without an `organisationId` filter. In `apps/backend/src/routers/task.router.ts`, `PUT /v1/task/pms/library/:libraryId`, `POST /v1/task/pms/templates`, `PATCH /v1/task/pms/templates/:templateId` and `DELETE /v1/task/pms/templates/:templateId` likewise lack organization/role enforcement. Any registered platform user, including a patient/companion-app account, can modify or delete another organization's service catalogue and PMS task-library/template data, affecting bookings and billing; service records can additionally be read without authentication. An earlier security change protected create routes but left these sibling operations exposed. A fixed release cannot be established from the available evidence.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.