Priority HIGH 75
OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE handlers that query records by id without session or authorId checks.
OpenHealthForAll
Records1All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9
Exploited now
OpenHealthForAll records in CISA KEVNo OpenHealthForAll vulnerabilities are listed in CISA KEV.
Records
1 record