CVE-2026-13381: VSee Clinic IDOR Vulnerability

CVE-2026-13381 Overview

CVE-2026-13381 is an Insecure Direct Object Reference (IDOR) vulnerability affecting VSee Clinic 7.1.26 and VSee Clinic API 1.3.0. The flaw resides in the /v1.3.0/api/files endpoint. An authenticated attacker can manipulate the remark request parameter to enumerate, retrieve, and delete files belonging to other tenants of the application server. The vulnerability is classified under CWE-639: Authorization Bypass Through User-Controlled Key and impacts confidentiality, integrity, and availability of stored files in a telehealth platform commonly used to process protected health information.

Critical Impact
Any authenticated user of the VSee Clinic platform can read and destroy files belonging to other users, exposing patient data and disrupting clinical workflows.

Affected Products

VSee Clinic 7.1.26
VSee Clinic API 1.3.0
Deployments exposing the /v1.3.0/api/files endpoint

Discovery Timeline

2026-07-20 - CVE-2026-13381 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-13381

Vulnerability Analysis

The vulnerability is a server-side authorization failure in the file management API of VSee Clinic. The /v1.3.0/api/files endpoint accepts a client-supplied remark parameter that the backend treats as a direct reference to stored file objects. The endpoint does not verify that the requesting session owns the referenced file before returning or deleting it. As a result, any authenticated user can substitute identifier values in the remark parameter to reach files owned by other accounts.

Because VSee Clinic is a telehealth product, the affected files often include clinical documents, images, and other protected health information. Exploitation requires only valid low-privileged credentials and can be automated to enumerate large ranges of identifiers. Successful requests return file contents in the response body, and DELETE-style operations remove the target file from the server.

Root Cause

The root cause is missing object-level authorization on the /v1.3.0/api/files endpoint. The handler resolves the remark parameter to a file record without cross-checking the record's owner against the authenticated principal. This is the canonical pattern described by CWE-639.

Attack Vector

Exploitation is performed over the network against the API. The attacker authenticates as any valid user, then issues requests to /v1.3.0/api/files while iterating values in the remark parameter. Each successful response discloses another user's file, and destructive variants of the request permanently remove files. See the SRA Labs analysis of VSee Clinic for the researcher's technical writeup.

Detection Methods for CVE-2026-13381

Indicators of Compromise

Sequential or high-volume requests to /v1.3.0/api/files from a single authenticated session with varying remark parameter values.
File download or deletion events where the responding record's owner does not match the requesting user's account.
Unexpected 200 responses on /v1.3.0/api/files immediately following failed enumeration attempts.

Detection Strategies

Instrument the API gateway to log the authenticated user identifier alongside the remark parameter and the resolved file owner for every call to /v1.3.0/api/files.
Alert when a single session accesses files associated with more than one distinct owner within a short time window.
Correlate application logs with authentication logs to identify low-privileged accounts issuing atypical volumes of file API calls.

Monitoring Recommendations

Forward VSee Clinic API access logs to a centralized analytics platform and retain them long enough to reconstruct enumeration campaigns.
Track baseline file access rates per user and flag statistical outliers.
Monitor file deletion events and require secondary review for bulk deletions across multiple accounts.

How to Mitigate CVE-2026-13381

Immediate Actions Required

Restrict access to the VSee Clinic API to trusted networks or VPN segments until a vendor patch is deployed.
Rotate credentials for accounts that have interacted with /v1.3.0/api/files and audit recent file access and deletion activity.
Preserve API and web server logs to support incident response and any regulatory reporting obligations for exposed health data.

Patch Information

As of the last NVD update on 2026-07-23, no vendor advisory or patched version is listed in the CVE record. Operators should consult the VSee Clinic product page and contact the vendor directly for remediation status. Refer to the SRA Labs blog post for additional technical context.

Workarounds

Place a reverse proxy or web application firewall in front of the API to block requests to /v1.3.0/api/files from unauthorized source ranges.
Enforce rate limiting on the affected endpoint to slow enumeration of the remark parameter.
Where feasible, disable non-essential file API functionality until authorization checks are validated by the vendor.

bash

# Example NGINX rule to restrict and rate-limit the vulnerable endpoint
limit_req_zone $binary_remote_addr zone=files_api:10m rate=10r/m;

location /v1.3.0/api/files {
    allow 10.0.0.0/8;
    deny all;
    limit_req zone=files_api burst=5 nodelay;
    proxy_pass http://vseeclinic_backend;
}