CVE-2026-111312
OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELET
CVSS
7.7
High
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Oct 15, 2026 · Last modified: Oct 15, 2026 · CWE-306
Not enough EPSS history yet.
OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE handlers that query records by id without session or authorId checks. Unauthenticated attackers who know a HealthData record id can read another user's medical record data and file metadata, overwrite it with arbitrary JSON, or delete it.
- github.comhttps://github.com/OpenHealthForAll/open-health
- github.comhttps://github.com/OpenHealthForAll/open-health/blob/v0.2.0/src/app/api/health-data/%5Bid%5D/route.ts#L13-L43
- github.comhttps://github.com/OpenHealthForAll/open-health/blob/v0.2.0/src/middleware.ts#L20
- hackmd.iohttps://hackmd.io/@hieuPenguinnn/open-health-health-data-id-missing-auth-idor
- www.vulncheck.comhttps://www.vulncheck.com/advisories/openhealth-through-0.2.0-missing-authentication-via-api-health-data-id-route
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1113229.8 CRI—
———Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* control API, which binds to 0.0.0.0 by default. Attackers with network access can send messages to the AI coding agent, which runs with bypassPermissions, to execute commands on the host as the Archon user.11hCVE-2026-1050389.8 CRI—
———The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication. An unauthenticated remote attacker can change AI model configuration and switch the model in use at runtime.12hCVE-2026-1050348.2 HIG—
———The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated remote attacker can obtain a valid device token for any serial number and act as that device against the cloud services.12hCVE-2026-847319.8 CRI—
——0An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application's authentication filters.
Consequently, the server responds with a Set-Cookie header containing a valid JSESSIONID. This session cookie decodes to a JSON Web Token (JWT) granting maximum cluster administrative privileges. Successful exploitation allows the attacker to execute root-level commands on all Controller VMs (CVMs) in the cluster, leading to complete cluster destruction and unauthorized access to VM memory and virtual disks.13hCVE-2026-39997—29.4%
——9A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to gain access to the system.
We have already fixed the vulnerability in the following version:
HybridDesk Station 4.2.22 and later16hCVE-2026-34006—43.8%
——13A missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE. If exploited, the vulnerability could allow remote attackers to gain access to the system.
We have already fixed the vulnerability in the following version:
sMedio DTCP MOVE 1.4.5 and later16h