🚨 Medkey EHR is vulnerable to an IDOR that can expose other patients’ records; CVE-2026-12207 PoC: https://github.com/r0xkrnl/Medkey-EHR-IDOR-PoC The flaw affects Medkey’s REST API and stems from insufficient authorization checks in the patient lookup functionality. An authenticated user can manipulate a patient ID value and retrieve records belonging to other patients. CVSS: 4.3 Medium Impact: Unauthorized access to patient information Affected: Medkey rolling-release builds through commit fc09b7ba9441ff590b72d428d5380834216b09ed The issue is tracked as CWE-99, Improper Control of Resource Identifiers, and can be exploited remotely with low privileges and no user interaction.
Post summary
The text discloses CVE-2026-12207, an IDOR in Medkey EHR's REST API, and explicitly shares a GitHub PoC link; no patch, named exploit tool, or active wild exploitation is mentioned.
