The epa4all-client Java client for ePA 3.0 is vulnerable when version 1.2.4 or earlier is deployed. An unauthenticated caller able to reach the REST API can write arbitrary documents into any patient’s electronic health record for that institution. Even without an SMC‑B card, the API permits data modification, directly compromising the integrity and confidentiality of patient information. The weakness is an Authentication Required flaw (CWE‑306).

The vulnerability affects oviva‑ag’s epa4all-client product for any installation running version 1.2.4 or earlier. Misconfigured deployments such as those illustrated by the project’s Docker example in the README allow the flaw to be exercised from a local network without credentials.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score is not available and the vulnerability is not yet listed in CISA’s KEV catalog. However, the attack requires only local network reachability and does not need user credentials, meaning an attacker inside the same network can exploit the API to tamper health records. Because the flaw directly bypasses authentication checks, the potential impact on patient data integrity is high and the likelihood of exploitation is significant in environments that have left the default configuration exposed.