Vulnerabilities

TI-2026-11338 CVE-2026-13381 · GHSA-5xwg-q2hm-f263

VSee Clinic and API Insecure Direct Object Reference in File API Allows Unauthorized File Access and Deletion

MEDIUM 40

VSee Clinic 7.1.26 and API 1.3.0 contain an Insecure Direct Object Reference (IDOR) vulnerability in the /v1.3.0/api/files endpoint.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00367 Published 2026-07-20 Fixed in 7.1.26.1, 1.3.0.1 CWE-639

TI-2026-11337 CVE-2026-13380 · GHSA-j3c3-jqmq-4785

LOW 39

VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints.

CVSS 4.0CRITICAL 9.0 Network No auth No interaction EPSS 0.00393 Published 2026-07-20 Fixed in 7.1.26.1, 1.3.0.1 CWE-201