The vulnerability is located in Medkey’s actionGetPatientById endpoint, where the ID parameter is accepted without proper validation or authorization checks, enabling a remote attacker to retrieve patient data belonging to other users. This incorrect handling of resource identifiers is a classic IDOR flaw and maps to CWE-99, allowing unauthorized read or modification of sensitive medical records.

All deployed versions of Medkey prior to commit fc09b7ba9441ff590b72d428d5380834216b09ed are affected. The vendor employs a rolling release model, so any instance still using a pre‑fix revision is potentially vulnerable.

With a CVSS score of 5.3, the flaw has moderate severity. An attacker can trigger it via a standard HTTP/HTTPS call to the REST API without needing local network access, and a public proof‑of‑concept confirms remote exploitation is possible. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog.