Read the docs
TI-2026-75334 Aliases CVE-2026-97851

Missing authorization in dcm4chee-arc-light enables object deletion

Priority MEDIUM 44CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

J4Care dcm4chee-arc-light from 5.35.1 before 5.35.2 lacks authorization checks (CWE-862) on its storage status-change REST service. A remote attacker without credentials or user interaction can change a location still tied to a DICOM instance to a deletion state. The PurgeStorageScheduler then deletes the referenced object from storage while the instance record stays in the database.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states. Changing a location to TO_DELETE causes PurgeStorageScheduler to delete the referenced object from storage even though the corresponding instance record remains in the database.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00349 28th percentileScored 2026-11-07
Fix Fixed dcm4chee-arc-light (J4Care): 5.35.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
J4Caredcm4chee-arc-light5.35.15.35.2Patch availableCNA
  • dcm4chee-arc-light VendorJ4Care Affected 5.35.1 Fixed in 5.35.2 Patch available CNA

Remediation

Update dcm4chee-arc-light to 5.35.2, the fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA dcm4chee-arc-light (J4Care) Fixed in 5.35.2

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-97851

References

Other 2

  • TI-2026-75325 J4Care dcm4che Missing Authentication for Critical Function CVSS 4.0CRITICAL 9.3
  • TI-2026-75328 Infinite loop in J4Care dcm4chee-arc-light JPEG parser CVSS 4.0HIGH 8.7
  • TI-2026-75324 J4Care dcm4che Loop with Unreachable Exit Condition CVSS 4.0HIGH 8.7
  • TI-2026-75323 Inefficient algorithm in J4Care dcm4chee-arc-light multipart parsing CVSS 4.0HIGH 8.7
  • TI-2026-75326 dcm4chee-arc-light accepts unauthenticated HL7 patient-merge messages CVSS 4.0HIGH 8.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences