The dcm4chee-arc-light REST API exposes a storage status-change endpoint that allows location records still linked to DICOM instances to be updated to deletion‑related states. Altering a location to TO_DELETE triggers the PurgeStorageScheduler to delete the associated file from storage, while the database record persists. Because this endpoint lacks proper authorization checks (CWE-862), an attacker can delete critical medical imaging data without ownership or privilege, leading to data loss and integrity compromise.

The flaw targets the J4Care dcm4chee-arc-light component. Versions released before 5.35.2 are vulnerable. Users should upgrade to release 5.35.2 or newer to obtain the authorization check.

The CVSS score of 8.8 indicates high severity. The vulnerability is likely exploitable over the network via the public REST service, although this inference is not explicitly stated in the description; this scenario would allow brute-force or credential‑guessing attempts. Although EPSS is not available and the issue is not listed in the CISA KEV catalogue, the lack of authorization control gives attackers a clear attack path to delete imaging files, compromising availability and confidentiality.