External risk intelligence

OpenHealth Missing Authentication and Authorization in Health Data API

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-111312

The vulnerability exists in an API endpoint (/api/health-data/[id]) designed to handle health data records. Web APIs are commonly deployed as internet-facing services to allow data access or integration. Given that this is a public-facing API path within a web application architecture, it is likely to be reachable from the internet in standard deployments.

Missing Authentication

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in OpenHealth software that allows unauthenticated attackers to access, modify, or delete another user's medical record data and file metadata. This issue stems from missing authentication and authorization checks in specific API handlers.

Unauthenticated users can access sensitive health data.
Leadership should remember this due to potential privacy breaches.
Confirm relevance and exposure of this health data vulnerability.

Attack Path

How an attacker could exploit the issue

An attacker can access sensitive health data by directly targeting an API endpoint that handles individual health records. Since this endpoint does not verify the user's identity or authorization, anyone who knows a specific record's ID can interact with it, potentially leading to unauthorized viewing, modification, or deletion of medical information.

No authentication or authorization required.
API endpoint with record ID.
Unauthorized data access or modification.

Live Threat

Current exploitation, exposure, and threat context

An attacker who knows a specific health data record ID could access, modify, or delete another user's medical record data and file metadata without needing to authenticate or be authorized. This could occur when the affected API endpoint is exposed externally and the attacker has knowledge of a valid record ID.

User medical record data.
Via unauthenticated API access.
Unauthorized data access or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in OpenHealth affects application owners responsible for the /api/health-data/[id] endpoints. The initial action should be to locate all instances of OpenHealth, determine their exposure and criticality, and identify the specific teams or individuals accountable for each deployment before planning remediation.

Application owners must prioritize this.
Verify API endpoint reachability and data criticality.
Plan remediation based on identified risks.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the OpenHealth software component?

OpenHealth is an open-source application framework designed to manage and store personal health data. It uses web-based API endpoints to facilitate the tracking of medical records and associated file metadata, serving as a backend service for digital health record management.

How does the CVE-2026-111312 vulnerability work?

This issue is a 'Missing Authentication for Critical Function' (CWE-306). It means the software fails to verify who is making a request before granting access. In this case, the API endpoints for accessing health records lack code to check if a user is logged in or permitted to view the requested ID, allowing bypass of security controls.

What triggers this vulnerability in the API?

The flaw is triggered when an unauthenticated actor sends a GET, PATCH, or DELETE request to the /api/health-data/[id] endpoint. The system does not check for a session or author ID, so simply possessing a valid record ID is sufficient to interact with the data. Requests that do not target a specific, valid record ID do not result in unauthorized data exposure.

How do I know if my OpenHealth instance is at risk?

According to Halo Surface Signal, this vulnerability is highly relevant because these API endpoints are often configured as internet-facing services to support data integration. If your deployment makes these API paths accessible over the public internet, it is likely reachable by unauthorized users.

What is the first step to secure my deployment?

Begin by auditing your environment to locate all instances where OpenHealth is running. Identify which endpoints are exposed to the network, particularly those handling health data. Once identified, consult with your development teams to confirm ownership and prioritize implementing proper authentication checks for these specific API handlers.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.