← Back to CVE Explorer

CVE-2026-13381

Full vulnerability record from the local CVENow database.

Description

VSee Clinic 7.1.26 and API 1.3.0 contain an Insecure Direct Object Reference (IDOR) vulnerability in the /v1.3.0/api/files endpoint. An authenticated attacker can manipulate the 'remark' request parameter to enumerate, retrieve, and delete files belonging to other users on the application server.

Severity
HIGH
CVSS score
8.7 (v4.0)
Vulnerability status
Analyzed
Source identifier
57dba5dd-1a03-47f6-8b36-e84e47d335d8
Published
2026-07-20 21:16:46.660000
Last modified
2026-10-24 20:10:00.137000
View original CVE JSON 
{
  "id": "CVE-2026-13381",
  "sourceIdentifier": "57dba5dd-1a03-47f6-8b36-e84e47d335d8",
  "published": "2026-07-20T21:16:46.660",
  "lastModified": "2026-10-24T20:10:00.137",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "VSee Clinic 7.1.26 and API 1.3.0 contain an Insecure Direct Object Reference (IDOR) vulnerability in the /v1.3.0/api/files endpoint. An authenticated attacker can manipulate the 'remark' request parameter to enumerate, retrieve, and delete files belonging to other users on the application server."
    },
    {
      "lang": "es",
      "value": "VSee Clinic 7.1.26 y API 1.3.0 contienen una vulnerabilidad de Referencia Directa Insegura a Objeto (IDOR) en el endpoint /v1.3.0/api/files. Un atacante autenticado puede manipular el parámetro de solicitud ’remark’ para enumerar, recuperar y eliminar archivos pertenecientes a otros usuarios en el servidor de aplicaciones."
    }
  ],
  "affected": [
    {
      "source": "57dba5dd-1a03-47f6-8b36-e84e47d335d8",
      "affectedData": [
        {
          "vendor": "VSee",
          "product": "Clinic",
          "defaultStatus": "unknown",
          "versions": [
            {
              "version": "7.1.26",
              "lessThan": "7.1.26.1",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "VSee",
          "product": "Clinic",
          "defaultStatus": "unknown",
          "modules": [
            "API"
          ],
          "versions": [
            {
              "version": "1.3.0",
              "lessThan": "1.3.0.1",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "57dba5dd-1a03-47f6-8b36-e84e47d335d8",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-21T16:39:05.735073Z",
          "id": "CVE-2026-13381",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "57dba5dd-1a03-47f6-8b36-e84e47d335d8",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:vsee:clinic:7.1.26:*:*:*:*:*:*:*",
              "matchCriteriaId": "0AD80BBB-9259-4D10-988C-26666D0CC6E8"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:vsee:clinic_api:1.3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "A3A65F6C-DFDE-4938-B81E-067CB6E84D43"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://labs.sra.io/posts/vseeclinic",
      "source": "57dba5dd-1a03-47f6-8b36-e84e47d335d8",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://vsee.com/clinic",
      "source": "57dba5dd-1a03-47f6-8b36-e84e47d335d8",
      "tags": [
        "Product"
      ]
    }
  ]
}