CVE-2026-13381

VSee Clinic and API Insecure Direct Object Reference in File API Allows Unauthorized File Access and Deletion

State: Published
Severity: 8.7 High
Published: Jul 20, 2026
Updated: Jul 21, 2026
Reserved: Jun 25, 2026

Description

VSee Clinic 7.1.26 and API 1.3.0 contain an Insecure Direct Object Reference (IDOR) vulnerability in the /v1.3.0/api/files endpoint. An authenticated attacker can manipulate the 'remark' request parameter to enumerate, retrieve, and delete files belonging to other users on the application server.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	SRA

Weaknesses

CWE-639 Authorization bypass through User-Controlled key

Affected Products

Product	Versions
ClinicVSee	7.1.26 to before 7.1.26.1Affected
ClinicVSee	1.3.0 to before 1.3.0.1Affected

References

https://labs.sra.io/posts/vseeclinicthird-party-advisory
https://vsee.com/clinicproduct

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.