CVE-2026-12207
Essential information
- Published
- 15/06/2026 04:16
- Modified
- 15/06/2026 20:42
- Author
- The MITRE Corporation
- Creator
- The MITRE Corporation
- CVSS
- 4.0 (v2) 4.3 MEDIUM (v3.1) 5.3 MEDIUM (v4.0)
- CISA KEV
- No
- CWE
- CWE-99
- CVSS vector
-
AV:N/AC:L/Au:S/C:P/I:N/A:NCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS metrics
- Access vector
- Network
- Access complexity
- Low
- Authentication
- Single
- Confidentiality impact
- Partial
- Integrity impact
- None
- Availability impact
- None
- Exploitability
- —
- Remediation level
- —
- Report confidence
- —
- Temporal score
- —
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality impact
- Low
- Integrity impact
- None
- Availability impact
- None
- Exploit code maturity
- —
- Remediation level
- —
- Report confidence
- —
- Temporal score
- —
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- Low
- User interaction
- None
- Confidentiality (V)
- Low
- Confidentiality (S)
- None
- Integrity (V)
- None
- Integrity (S)
- None
- Availability (V)
- None
- Availability (S)
- None
- Exploit maturity
- PROOF_OF_CONCEPT
Description
A security flaw has been discovered in medkey-org medkey up to fc09b7ba9441ff590b72d428d5380834216b09ed. Impacted is the function actionGetPatientById of the file app\modules\medical\port\rest\controllers\PatientController.php of the component HTTP REST API. The manipulation of the argument ID results in improper control of resource identifiers. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way.
NVD status
- Status
- Deferred — CVE has been recently published to the CVE List and has been received by the NVD.
- Source
- [email protected]
- NVD
- View on NVD
Affected products (CPE)
| Product | CPE |
|---|---|
| medkey-org / medkey | cpe:2.3:a:medkey-org:medkey:*:*:*:*:*:*:*:* |