← CVE Intelligence

CVE-2026-13381

VSee Clinic and API Insecure Direct Object Reference in File API Allows Unauthorized File Access and Deletion PUBLISHED

Description (CNA)

VSee Clinic 7.1.26 and API 1.3.0 contain an Insecure Direct Object Reference (IDOR) vulnerability in the /v1.3.0/api/files endpoint. An authenticated attacker can manipulate the 'remark' request parameter to enumerate, retrieve, and delete files belonging to other users on the application server.

Affected (CNA)

Vendor / productVersions
VSee / Clinicaffected 7.1.26 before 7.1.26.1
VSee / Clinicaffected 1.3.0 before 1.3.0.1

CWE

CWE-639

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.