CVE-2026-13381

HighCVSS 8.1

Published: 20/07/2026(UTC)Updated: 14/08/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

12th percentile - higher than 12% of all known CVEs

Summary

VSee Clinic 7.1.26 and API 1.3.0 contain an IDOR vulnerability in the /v1.3.0/api/files endpoint. An authenticated attacker can manipulate the 'remark' parameter to enumerate, retrieve, and delete other users' files.

Risk Assessment

An attacker could access sensitive patient data or delete critical files, compromising system confidentiality and integrity.

Recommendation

Update VSee Clinic and API to the latest version and implement object-level access controls.

Other vulnerabilities in VSee Clinic

CVE-2026-13380High
VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 expose cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are present only when SFTP connections have been configured. No authentication is required. An unauthenticated remote attacker who observes these HTTP responses can obtain the credentials and access the associated SFTP server.

Original NVD description (English source)

VSee Clinic 7.1.26 and API 1.3.0 contain an Insecure Direct Object Reference (IDOR) vulnerability in the /v1.3.0/api/files endpoint. An authenticated attacker can manipulate the 'remark' request parameter to enumerate, retrieve, and delete files belonging to other users on the application server.