CVE-2026-103089: When a Document ID Exposes Another Patient’s Records

An IDOR vulnerability in a medical web application

A patient portal is supposed to show you your own medical documents. In this case, an authenticated user could change a document ID in a request and receive a link to a document belonging to someone else. A valid session was being checked, but the authorization for the specific document was missing.

The issue

The application passed a numeric document ID to the server when requesting a link to a medical record. The server accepted a valid logged-in session without adequately verifying that the requested document belonged to that user. Changing the ID could therefore cross the boundary between one patient's records and another's.

This is an Insecure Direct Object Reference (IDOR), also known as Broken Object Level Authorization (BOLA). An object ID identifies a record but it should not grant permission to read it automatically. OWASP's guidance on BOLA explains the underlying access-control failure and how to prevent it.

Why it matters

The documents in question were medical records. Unauthorized access could expose highly sensitive health information. The scenario required an authenticated patient account, nonetheless the severity of someone else accessing your individual medical documents is not something that "should not be fixed just because one would need an authenticated account".

The lesson for document portals

Every request for a document needs a server-side check that the current user is allowed to access that exact document. If a separate download URL exists, the authorization must hold there as well. Unpredictable IDs, login requirements, and rate limits can add protection, but none replaces object-level authorization. Operators should apply the available updates and review similar endpoints for the same flaw.

CVE-2026-103089 was handled through coordinated disclosure with CERT.at.

• Usagi Sennin