Missing Authentication Vulnerability in OpenHealth API by OpenHealth For All

CVE-2026-111312

What is CVE-2026-111312?

OpenHealth versions up to 0.2.0 have a vulnerability in the /api/health-data/[id] handlers that allows unauthorized access to sensitive health data. This flaw exists due to a lack of authentication and authorization checks for GET, PATCH, and DELETE requests. Attackers who possess a HealthData record ID can exploit this vulnerability to read other users' medical records, modify them with arbitrary data, or delete them entirely. The absence of session verification and authorId checks underscores a critical gap in data protection, necessitating immediate attention from users and developers.

References