CVE-2026-49120

Medplum before 5.1.14 contains a server-side request forgery vulnerability in the subscription worker that allows authenticated users to perform unauthorized internal network requests by creating FHIR Subscription resources with arbitrary endpoint URLs. Attackers can point subscription endpoints ...

PT-2026-45843

Name of the Vulnerable Software and Affected Versions Medplum versions prior to 5.1.14 Description An issue in the subscription worker allows authenticated users to perform unauthorized internal network requests. By creating FHIR Subscription resources with arbitrary endpoint URLs, attackers can...