The vulnerability resides in missing organization and permission checks on several service and PMS routes. Endpoints such as PATCH, DELETE, and PUT for service records and PMS libraries lack the required withOrgPermissions() and requirePermission(...) middleware, and a GET endpoint has no authentication at all. This omission allows any registered platform user—including patient‑ or companion‑app accounts—to view, modify, or delete data belonging to other organizations, directly affecting bookings and billing. The defect is a clear example of CWE‑639 (authorization bypass) and CWE‑862 (missing authorization).

The affected application is YosemiteCrew, a service and task management platform. The flaw appears in the main snapshot and development snapshots of the backend. Specific routes impacted include service endpoints under /fhir/v1/service/:id and task‑library/template endpoints under /v1/task/pms. No specific version numbers are disclosed, but the issue exists in development snapshots that were publicly released at the time of the advisory.

A CVSS score of 8.3 indicates high severity. Although EPSS data is not available, the attack surface is wide: a simple authentication token is sufficient to reach the vulnerable endpoints, and some endpoints do not require authentication whatsoever. The lack of an organizationId filter in the data lookup chain further simplifies exploitation. Since the vulnerability is not listed in the CISA KEV catalog, there is no indication of active exploitation, but the potential impact for confidentiality, integrity, and availability is significant, especially for billing and service records. The likely attack vector is a network‑based HTTP request to the exposed endpoints, requiring only a valid user token for many actions.