EUVD-2026-102476

OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/id GET, PATCH and DELETE handlers that query records by id without session or authorId checks. Unauthenticated attackers who know a HealthData record id can read another user's medic...

CVE-2026-111312 OpenHealth through 0.2.0 Missing Authentication via /api/health-data/[id] Route

OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/id GET, PATCH and DELETE handlers that query records by id without session or authorId checks. Unauthenticated attackers who know a HealthData record id can read another user's medic...

CVE-2026-111312

The OpenHealth application (versions through 0.2.0 ) is vulnerable to a missing authentication and authorization flaw in the /api/health-data/[id] route. The GET , PATCH , and DELETE handlers fail to perform necessary session or authorId checks when querying records by ID. Consequently, an unauth...

PT-2026-115276

Name of the Vulnerable Software and Affected Versions OpenHealth versions prior to 0.2.1 Description Missing authentication and authorization in the '/api/health-data/id' GET, PATCH, and DELETE handlers allow unauthenticated attackers to access medical records. By knowing a HealthData record id, ...