Live › vulnerability › CVE-2026-59979
Go to dashboardYosemiteCrew's service and PMS task-template routes skip organization and permission checks, so any registered account can modify or delete another organization's service catalogue and task templates. Some service records can also be read without logging in.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 16:33 UTC. All times on this page are UTC.
Deployments of YosemiteCrew's backend that expose the service and PMS task routes to user accounts, including patient or companion-app accounts that can register on the platform. Multi-organization deployments are most exposed, because the flaw lets one organization change another's bookings and billing data. Single-tenant setups with no outside registration have much less exposure.
No product ranges from the sources yet.
apps/backend/src/middlewares/auth.ts lacks withOrgPermissions() and requirePermission(...) on the service and task routes)GET /fhir/v1/service/:id answers without an Authorization headerPATCH and DELETE /fhir/v1/service/:id, GET /fhir/v1/service/:id and the /v1/task/pms/ library and template routesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
YosemiteCrew provides organization-based service and task management. In the source-reported affected main and dev snapshots, YosemiteCrew's service and PMS task-library/template routes omit organization and permission checks. authorizeCognito in apps/backend/src/middlewares/auth.ts sets the authenticated user's ID but does not provide the withOrgPermissions() and requirePermission(...) checks used by protected siblings. In apps/backend/src/routers/service.router.ts, PATCH /fhir/v1/service/:id and DELETE /fhir/v1/service/:id are authentication-only, while GET /fhir/v1/service/:id has no authentication middleware. The trace through apps/backend/src/controllers/web/service.controller.ts to apps/backend/src/services/service.service.ts passes a global record ID into ServiceModel.findById(oid) without an organisationId filter. In apps/backend/src/routers/task.router.ts, PUT /v1/task/pms/library/:libraryId, POST /v1/task/pms/templates, PATCH /v1/task/pms/templates/:templateId and DELETE /v1/task/pms/templates/:templateId likewise lack organization/role enforcement. Any registered platform user, including a patient/companion-app account, can modify or delete another organization's service catalogue and PMS task-library/template data, affecting bookings and billing; service records can additionally be read without authentication. An earlier security change protected create routes but left these sibling operations exposed. A fixed release cannot be established from the available evidence.
This page as .md · .json · in your agent: get_signal("CVE-2026-59979")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.