OpenHealth vulnerabilities

CVEs whose affected-version data names the OpenHealth package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-111312High· 7.7

yesterday

OpenHealth through 0.2.0 Missing Authentication via /api/health-data/[id] Route

OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE handlers that query records by id without session or authorId checks. Unauthenticated attackers…

▾ TwilightOpenHealthForAll · OpenHealthvia CVEORG