Auth bypass in Vsee Clinic

CVE-2026-13381

VSee Clinic 7.1.26 and API 1.3.0 contain an Insecure Direct Object Reference (IDOR) vulnerability in the /v1.3.0/api/files endpoint. An authenticated attacker can manipulate the 'remark' request parameter to enumerate, retrieve, and delete…

Vulnerability class: IDOR (Insecure Direct Object Reference)

Affected products

Vsee Clinic — versions 7.1.26, 1.3.0

Weakness classification (CWE)

CWE-639 — Authorization Bypass Through User-Controlled Key

References

57dba5dd-1a03-47f6-8b36-e84e47d335d8 (third-party-advisory)
57dba5dd-1a03-47f6-8b36-e84e47d335d8 (product)