github.comexploit
https://github.com/onyxglitch/Medkey-EHR-IDOR-PoC CVE-2026-12207
MEDIUM
medkey-org medkey HTTP REST API PatientController.php actionGetPatientById resource injection
Record summary
CVE-2026-12207 has a selected CVSS score of 5.3 (medium).
Description
A security flaw has been discovered in medkey-org medkey up to fc09b7ba9441ff590b72d428d5380834216b09ed. Impacted is the function actionGetPatientById of the file app\modules\medical\port\rest\controllers\PatientController.php of the component HTTP REST API. The manipulation of the argument ID results in improper control of resource identifiers. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 15, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
| CVE List | fc09b7ba9441ff590b72d428d5380834216b09ed | affected |
References
6nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-12207 CVE-2026-12207 | CVE Analysis and ReportThird-party advisory
https://vuldb.com/cve/CVE-2026-12207 Submit #831893 | medkey-org medkey v 1.0.0 Insecure Direct Object Reference (IDOR) /Improper Access ControlThird-party advisory
https://vuldb.com/submit/831893 VDB-370849 | medkey-org medkey HTTP REST API PatientController.php actionGetPatientById resource injectionvdb entryTechnical description
https://vuldb.com/vuln/370849 VDB-370849 | CTI Indicators (IOB, IOC, IOA)signaturepermissions required
https://vuldb.com/vuln/370849/cti