The vulnerability is a missing authentication check for ADT^A40 patient‑merge messages accepted by the HL7 listener. An unauthenticated sender can reassign studies and associated workflow records from one patient identity to another, effectively tampering with medical data. This flaw can change the provenance of imaging studies, leading to potential data integrity violations and misinformation in downstream applications.

The flaw affects the J4Care dcm4chee-arc-light HL7 archiving component. Versions prior to release 5.35.2 are impacted. Administrators using the default configuration of this component should verify whether their deployment includes a patched release.

The CVSS score of 8.7 indicates high severity. The EPSS score is not available, and the vulnerability is not present in the CISA KEV catalogue, suggesting no readily known exploit. Nevertheless, the likely attack vector is remote, requiring an external actor to transmit a malicious HL7 ADT^A40 message over the network. Because the flaw resides in the default configuration, any system exposing the listener to an untrusted network segment is vulnerable; remediation is straightforward via the vendor’s patch.