CVE-2026-12207: Medkey Patient Data Exposure via Improper API Access Control

Technical summary

CVE-2026-12207 is an improper resource identifier control vulnerability (CWE-99) in the actionGetPatientById function within medkey's PatientController.php REST API endpoint. The vulnerability allows authenticated attackers to bypass access controls by manipulating the ID parameter, gaining unauthorized read access to patient records. The affected version is up to commit fc09b7ba9441ff590b72d428d5380834216b09ed. Medkey uses a rolling release model, so traditional version numbers are not available; patches, if released, would be distributed as commits to the repository.

Business impact

Unauthorized access to patient medical records violates HIPAA, GDPR, and other healthcare privacy regulations, exposing organizations using medkey to significant compliance violations, financial penalties, and reputational damage. In a healthcare context, data breach notifications may be required. The attack requires authentication, limiting the blast radius to internal users or those with valid credentials, but the impact on any exposed patient data is severe.

Affected systems

Medkey installations running on or before commit fc09b7ba9441ff590b72d428d5380834216b09ed are affected. The vendor did not respond to early disclosure notifications and has not published patch information. Because medkey uses rolling releases without traditional version numbering, affected installations must verify their current commit hash against the disclosed commit. All deployments of medkey should be considered potentially vulnerable unless explicitly patched.

Exploitability

The vulnerability is exploitable with low attack complexity and requires valid authentication credentials (CVSS PR:L). No user interaction is needed. Public exploit code has been released, meaning attack tools and techniques are available. Threat actors with legitimate or compromised medkey user accounts can immediately exploit this flaw to enumerate and access patient records at scale.

Remediation

Organizations must obtain a patched version of medkey that resolves the improper resource identifier control in the PatientController.php actionGetPatientById function. Verify your current installation's commit hash against the disclosed vulnerable commit. Until a patch is available or confirmed, implement compensating controls: restrict HTTP REST API access by network segmentation, audit all actionGetPatientById API calls, enforce least-privilege access for medkey user roles, and monitor for suspicious ID parameter patterns in logs.

Patch guidance

Medkey's rolling release model means patches are distributed as code commits rather than versioned releases. Check the medkey repository for commits after fc09b7ba9441ff590b72d428d5380834216b09ed that address CWE-99 in PatientController.php. Verify the patch by examining the code diff to confirm that ID parameter validation and authorization checks have been strengthened. The vendor's lack of response to early disclosure suggests patch availability and timeline are uncertain; prioritize monitoring the repository and security advisories closely.

Detection guidance

Monitor PatientController.php actionGetPatientById API endpoint logs for: unusual ID parameter values (sequential, out-of-range, or non-matching user context), repeated requests with different IDs from a single user session, access patterns inconsistent with legitimate patient lookup workflows, and API calls from service accounts or unexpected origins. Implement application-level logging that ties each API request to the authenticated user and the specific patient record returned. Review access logs for the past 90 days to identify potential exploitation.

Why prioritize this

Although the CVSS score of 4.3 is moderate, the vulnerability affects protected health information in a medical system, triggering regulatory urgency. Public exploit availability and vendor non-responsiveness mean active exploitation is likely. Authentication requirement limits immediate risk compared to unauthenticated flaws, but healthcare organizations must treat this as high priority due to privacy and compliance obligations.

Risk score, explained

CVSS 3.1 score of 4.3 (MEDIUM) reflects a remote, low-complexity attack requiring authentication that results in confidentiality loss but no integrity or availability impact. In healthcare contexts, confidentiality breaches of patient data carry outsized business and regulatory consequences not fully captured by the base CVSS score. Organizations should apply a healthcare-specific risk multiplier and treat this vulnerability as higher priority than the numeric score alone suggests.

Frequently asked questions