A cross‑site request forgery flaw in Merge PACS 7.0 allows an attacker to craft a malicious HTML form that submits a POST request to the merge‑viewer endpoint. By sending credentials to /servlet/actions/merge‑viewer/summary, the attacker can hijack the victim’s session and gain unauthorized access to the PACS system.

The vulnerability affects Merge’s PACS product, version 7.0. All releases of 7.0 are potentially impacted because no specific patch level or build is indicated.

The flaw has a CVSS score of 6.9, classifying it as medium severity. The EPSS score is not available, so the likelihood of exploitation is unknown. The flaw is not listed in the CISA KEV catalog. Because the attacker must send a crafted POST request while the user is logged in, the exploitation path is straightforward for an adversary who can lure the victim to submit the form. Without a vendor patch, standard CSRF defenses such as synchronizer tokens, same‑origin checks, and strict session handling can mitigate the risk.