A flaw in OpenHealth before version 0.2.0 allows unauthenticated users to invoke the /api/health-data/[id] GET, PATCH and DELETE endpoints. The application fails to verify a session or the owning authorId for the requested record, so knowledge of a record identifier gives an attacker the ability to read, overwrite with arbitrary content, or delete another person's health data and associated file metadata. The vulnerability is a classic Missing Authentication weakness (CWE-306).

Vulnerable deployments of the OpenHealthForAll OpenHealth application running any release up through 0.2.0 are impacted. The issue resides in the route handling code located under src/app/api/health-data/[id]/route.ts and the middleware that is currently insufficient to enforce authentication. Users should verify that their instance is not using a 0.2.0 build or any earlier release that has not been patched.

The CVSS score of 9.2 indicates a critical severity, and the lack of authentication enables attackers to compromise confidentiality, integrity, and availability of protected health information. The EPSS score of 0.00451 indicates a very low but nonzero probability of exploitation, yet the publicly available references and the nature of the vulnerability suggest that exploitation is feasible with minimal effort once a record ID is known. The application is not listed in the CISA KEV catalog at present. The likely attack vector is through an attacker who can guess or obtain a valid record identifier, then directly request the vulnerable endpoint without any authentication headers.