CVE-2026-12207
A security flaw has been discovered in medkey-org medkey up to fc09b7ba9441ff590b72d428d5380834216b09ed. Impacted is the function actionGetPatientById of the file app\modules\medical\port\rest\controllers\PatientController.php of the component HTTP REST API. The manipulation of the argument ID results in improper control of resource identifiers. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.3
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
- EPSS probability
- 0.23%
- CWE
- CWE-99
- Published
- 2026-06-15
- Last modified
- 2026-06-15
Affected products
- medkey-org medkey
Weakness type
Related vulnerabilities
- CVE-2026-81524 — Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C Driver
- CVE-2026-81521 — Cross-database write retargeting via unvalidated dotted database name in Client.BulkWrite in the MongoDB Go Driver
- CVE-2026-62910 — Microsoft Exchange Server Elevation of Privilege Vulnerability
- CVE-2026-15186 — macrozheng mall Portal Endpoint create resource injection
- CVE-2026-13493 — AIDC-AI ComfyUI-Copilot Workflow Checkpoint Restore conversation_api.py resource injection
- CVE-2026-10624 — SourceCodester Human Resource Management Employee View detailview.php resource injection
- CVE-2026-10299 — code-projects Online Hospital Management System viewdoctortimings.php resource injection
- CVE-2026-10168 — OUSL-GROUP-BrinaryBrains School Student Management System Parents.php marks resource injection