Medkey EHR · Public exploit code

IDOR in Medkey EHR exposes other patients' records; PoC public

Oct 26, 2026 · 1 min read

An IDOR flaw (CVE-2026-12207, CVSS 4.3) in the Medkey EHR REST API lets an authenticated user manipulate a patient ID and retrieve other patients' records. A PoC is public and no fix has been disclosed. Restrict access to the patient lookup and monitor for anomalous queries until a patch ships.

By HIFY Radar newsroom Updated 10/26/2026 04:16 PM Get this every day →← Back to the feed 1 source

MediumVulnerabilityPublic exploit codeFix unconfirmed

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

A flaw in the Medkey EHR electronic health record system lets a user with a valid account view other patients' records by changing the identifier in a lookup. The flaw is tracked as CVE-2026-12207, medium severity (CVSS 4.3). A public proof of concept is already circulating.

Why it matters

Medical records hold sensitive health data and exposure can trigger legal and regulatory duties such as incident notification. Hospitals and clinics running Medkey face unauthorized access to patient information by any low-privilege account, including compromised ones.

What to do

Check with the vendor for a fix covering rolling-release builds through commit fc09b7ba. Until a patch ships, restrict the Medkey REST API to the internal network or VPN and review patient lookup logs for anomalous patterns.

For the technical team

CVE: CVE-2026-12207
Affected: Medkey EHR (API REST, funcionalidade de busca de pacientes) · Medkey rolling-release builds through commit fc09b7ba9441ff590b72d428d5380834216b09ed.
Exploitation: Public PoC reported by the DarkWebInformer account. No in-the-wild exploitation reported in the sources.
Fix: No fix disclosed in the sources.
Vector: IDOR (CWE-99, Improper Control of Resource Identifiers) in the Medkey EHR REST API: insufficient authorization checks in the patient lookup functionality. An authenticated low-privilege user manipulates the patient ID value and retrieves other patients' records. Exploitable remotely with no user interaction.
More details: Tracked as CVE-2026-12207, CVSS 4.3 (medium). Reported impact: unauthorized access to patient information. Single source: DarkWebInformer post (2026-10-26). The incident record cites a truncated commit hash; the full hash appears only in the source.