CVE-2026-47672
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
epa4all-client version 1.2.4 and earlier allows any network-reachable caller to write arbitrary documents to any patient's electronic health record using the institution's SMC-B card. In a misconfigured deployment (e.g., following the Docker example in the README), this is exploitable from the local network without credentials.
Risk Assessment
An attacker can unauthorizedly modify patient medical records, compromising data integrity and privacy.
Recommendation
Update epa4all-client to the latest version and configure proper authentication and authorization mechanisms.
Other vulnerabilities in epa4all-client
See all- CVE-2026-45574High
The epa4all-client library (Java Client for epa4all / ePA 3.0 in Telematik Infrastruktur) prior to version 1.2.2 does not properly validate TLS certificates. An attacker on the network path between the ePA service and the Konnektor can present any TLS certificate (self-signed, expired, wrong CN) and intercept all SOAP traffic, including patient identifiers (KVNR), SMC-B card operations, document content, and credential exchanges.
- CVE-2026-44900High
In the epa4all-client Java client, the SignedPublicKeysTrustValidatorImpl.isTrusted() method discards the boolean return value of ECDSA signature verification, always returning true for any structurally valid signature.
- CVE-2026-45575High
In the epa4all-client Java client, a MITM attacker on the TLS connection between client and IDP can substitute a forged discovery document, redirecting the client to attacker-controlled URLs. The client then encrypts the SMC-B signed challenge response with the attacker's key and sends it to the attacker.
Original NVD description (English source)
epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. In 1.2.4 and earlier, any network-reachable caller can write arbitrary documents to any patient's electronic health record accessible by the institution's SMC-B card. In a misconfigured deployment (e.g., following the production Docker example in the README), this is exploitable from the local network without credentials.