CVE-2026-59979
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
In YosemiteCrew, service and PMS task-library/template routes omit organization and permission checks. Any authenticated platform user, including a patient account, can modify or delete another organization's service catalogue and PMS template data, and service records can be read without authentication.
Risk Assessment
Unauthorized modification or deletion of another organization's service catalogue and PMS data is possible, affecting bookings and billing, along with unauthenticated read access to service records.
Recommendation
Until a fix is available, restrict access to the listed service and PMS library/template routes and enforce organization and permission checks equivalent to protected sibling routes.
Related vulnerabilities
- CVE-2026-28336Critical
SolarWinds Dameware is affected by a command injection vulnerability that could lead to compromise of the remotely controlled host. Authentication is required.
- CVE-2026-109593Critical
An unauthenticated attacker with network access to SonicWall GMS 9.5.2 and earlier may be able to read internal GMS files, potentially exposing sensitive information.
- CVE-2026-121260Critical
Ziroom ZHOME A0101 1.0.1.0 Build 202004151405 contains a flaw in the loadstring function of usr/lib/lua/luci/controller/api/zrUsb.lua (Lua Handler component). The manipulation causes code injection and can be exploited remotely. The exploit has been published and may be used; the vendor did not respond to the disclosure.
- CVE-2026-118527MediumActively exploited
Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.
- CVE-2026-89292Critical
In Eclipse Mnestix Browser versions 1.6.0 up to but excluding 2.3.0, an unauthenticated attacker could exfiltrate the MNESTIX_BACKEND_API_KEY for all configured Infrastructures.
- CVE-2026-4052Critical
This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Server token endpoint.
- CVE-2026-13594Critical
Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversary to gain unauthorized access to the product.
- CVE-2026-120534Critical
The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function. Insufficient validation of form configuration parameters allows unauthenticated attackers to call arbitrary WordPress functions with controlled arguments.
- CVE-2026-120518Critical
The BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.1.0. The bpxp_image_field_update_on_user_activation() function calls unlink() on a path built from visitor-supplied signup metadata without realpath() resolution, containment check, or extension allow-list.
- CVE-2026-86596Critical
The s2Member plugin for WordPress in versions up to and including 260927 is vulnerable to Remote Code Execution via the 'item_name' parameter. Insufficient sanitization in strip_php_tags_deep() only strips literal '<?' sequences, and a post-interpolation placeholder cleanup reassembles a valid '<?php' opener after the attacker-controlled value has already been embedded in the email template.
Original NVD description (English source)
YosemiteCrew provides organization-based service and task management. In the source-reported affected main and dev snapshots, YosemiteCrew's service and PMS task-library/template routes omit organization and permission checks. `authorizeCognito` in `apps/backend/src/middlewares/auth.ts` sets the authenticated user's ID but does not provide the `withOrgPermissions()` and `requirePermission(...)` checks used by protected siblings. In `apps/backend/src/routers/service.router.ts`, `PATCH /fhir/v1/service/:id` and `DELETE /fhir/v1/service/:id` are authentication-only, while `GET /fhir/v1/service/:id` has no authentication middleware. The trace through `apps/backend/src/controllers/web/service.controller.ts` to `apps/backend/src/services/service.service.ts` passes a global record ID into `ServiceModel.findById(oid)` without an `organisationId` filter. In `apps/backend/src/routers/task.router.ts`, `PUT /v1/task/pms/library/:libraryId`, `POST /v1/task/pms/templates`, `PATCH /v1/task/pms/templates/:templateId` and `DELETE /v1/task/pms/templates/:templateId` likewise lack organization/role enforcement. Any registered platform user, including a patient/companion-app account, can modify or delete another organization's service catalogue and PMS task-library/template data, affecting bookings and billing; service records can additionally be read without authentication. An earlier security change protected create routes but left these sibling operations exposed. A fixed release cannot be established from the available evidence.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS