{"id":"CVE-2026-59979","kind":"vulnerability","aliases":["CVE-2026-59979"],"related":[],"title":"YosemiteCrew: any user can edit or delete other organizations' service and task data","description":"YosemiteCrew provides organization-based service and task management. In the source-reported affected main and dev snapshots, YosemiteCrew's service and PMS task-library/template routes omit organization and permission checks. `authorizeCognito` in `apps/backend/src/middlewares/auth.ts` sets the authenticated user's ID but does not provide the `withOrgPermissions()` and `requirePermission(...)` checks used by protected siblings. In `apps/backend/src/routers/service.router.ts`, `PATCH /fhir/v1/service/:id` and `DELETE /fhir/v1/service/:id` are authentication-only, while `GET /fhir/v1/service/:id` has no authentication middleware. The trace through `apps/backend/src/controllers/web/service.controller.ts` to `apps/backend/src/services/service.service.ts` passes a global record ID into `ServiceModel.findById(oid)` without an `organisationId` filter. In `apps/backend/src/routers/task.router.ts`, `PUT /v1/task/pms/library/:libraryId`, `POST /v1/task/pms/templates`, `PATCH /v1/task/pms/templates/:templateId` and `DELETE /v1/task/pms/templates/:templateId` likewise lack organization/role enforcement. Any registered platform user, including a patient/companion-app account, can modify or delete another organization's service catalogue and PMS task-library/template data, affecting bookings and billing; service records can additionally be read without authentication. An earlier security change protected create routes but left these sibling operations exposed. A fixed release cannot be established from the available evidence.","summary":"YosemiteCrew's service and PMS task-template routes skip organization and permission checks, so any registered account can modify or delete another organization's service catalogue and task templates. Some service records can also be read without logging in.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["billing","healthcare","multi-tenant","package","self-hosted","yosemitecrew"],"not_affected_if":["registration-disabled","single-organization"],"how_to_check":"- Check whether the deployment runs YosemiteCrew backend from the affected main or dev snapshots (`apps/backend/src/middlewares/auth.ts` lacks `withOrgPermissions()` and `requirePermission(...)` on the service and task routes)\n- Confirm whether `GET /fhir/v1/service/:id` answers without an Authorization header\n- unknown for a definitive version check: the sources do not give a fixed release","fix":"- Move to a YosemiteCrew release that adds organization and permission checks to `PATCH` and `DELETE /fhir/v1/service/:id`, `GET /fhir/v1/service/:id` and the `/v1/task/pms/` library and template routes\n- unknown for a fixed version: the sources say a fixed release cannot be established\n- Until patched, restrict access to the backend API to trusted users only","status":"open","published_at":"2026-10-28T16:17:08+00:00","first_seen_at":"2026-10-28T16:33:49+00:00","triaged_at":"2026-10-28T16:35:50+00:00","updated_at":"2026-10-28T16:35:50+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T16:35:50Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a YosemiteCrew release that adds organization and permission checks to `PATCH` and `DELETE /fhir/v1/service/:id`, `GET /fhir/v1/service/:id` and the `/v1/task/pms/` library and template routes\n- unknown for a fixed version: the sources say a fixed release cannot be established\n- Until patched, restrict access to the backend API to trusted users only","reach":"internet","title":"YosemiteCrew: any user can edit or delete other organizations' service and task data","impact":"high","summary":"YosemiteCrew's service and PMS task-template routes skip organization and permission checks, so any registered account can modify or delete another organization's service catalogue and task templates. Some service records can also be read without logging in.","category":"package","nicknames":[],"who_cares":["yosemitecrew","self-hosted","healthcare","multi-tenant","billing"],"confidence":0.6,"needs_auth":"yes","worst_case":"Other organizations' service catalogues and billing task templates are altered or deleted; some records readable without login","analyst_note":"Find the fixed release and the commit that adds organization checks to the service and task routes, from the NVD entry or the project repository.","how_to_check":"- Check whether the deployment runs YosemiteCrew backend from the affected main or dev snapshots (`apps/backend/src/middlewares/auth.ts` lacks `withOrgPermissions()` and `requirePermission(...)` on the service and task routes)\n- Confirm whether `GET /fhir/v1/service/:id` answers without an Authorization header\n- unknown for a definitive version check: the sources do not give a fixed release","needs_analyst":true,"not_affected_if":["single-organization","registration-disabled"],"who_is_affected":"Deployments of YosemiteCrew's backend that expose the service and PMS task routes to user accounts, including patient or companion-app accounts that can register on the platform. Multi-organization deployments are most exposed, because the flaw lets one organization change another's bookings and billing data. Single-tenant setups with no outside registration have much less exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000751,"input_tokens":3740,"output_tokens":754,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-59979':16A,19A '/fhir/v1/service':128C,132C,140C '/template':96C,204C '/v1/task/pms/library':167C '/v1/task/pms/templates':170C,172C,176C 'account':47B,189C 'addit':213C 'affect':83C,206C 'also':64B 'anoth':52B,194C 'apps/backend/src/controllers/web/service.controller.ts':149C 'apps/backend/src/middlewares/auth.ts':105C 'apps/backend/src/routers/service.router.ts':126C 'apps/backend/src/routers/task.router.ts':165C 'apps/backend/src/services/service.service.ts':151C 'authent':108C,136C,144C,217C 'authentication-on':135C 'authorizecognito':103C 'avail':239C 'base':73C 'bill':20B,209C 'book':207C 'cannot':234C 'catalogu':56B,198C 'chang':221C 'check':43B,102C,120C 'creat':223C 'cve':14A,17A 'data':13A,205C 'delet':7A,51B,131C,175C,193C 'dev':86C 'earlier':219C 'edit':5A 'enforc':181C 'establish':236C 'evid':240C 'expos':230C 'filter':163C 'fix':232C 'get':139C 'global':154C 'healthcar':21B 'host':28B 'id':111C,129C,133C,141C,156C 'includ':186C 'lack':179C 'left':226C 'librari':95C,203C 'libraryid':168C 'likewis':178C 'log':68B 'main':84C 'manag':77C 'middlewar':145C 'modifi':49B,191C 'multi':23B 'multi-ten':22B 'oid':159C 'omit':98C 'oper':229C 'organ':9A,40B,53B,72C,99C,195C 'organisationid':162C 'organization-bas':71C 'organization/role':180C 'packag':25B 'pass':152C 'patch':127C,171C 'patient/companion-app':188C 'permiss':42B,101C 'platform':184C 'pms':34B,92C,200C 'post':169C 'protect':123C,222C 'provid':70C,115C 'put':166C 'read':66B,215C 'record':62B,155C,211C 'regist':46B,183C 'releas':233C 'report':82C 'requirepermiss':119C 'rout':38B,97C,224C 'secur':220C 'self':27B 'self-host':26B 'servic':10A,32B,55B,61B,74C,90C,197C,210C 'servicemodel.findbyid':158C 'set':106C 'sibl':124C,228C 'skip':39B 'snapshot':87C 'sourc':81C 'source-report':80C 'task':12A,36B,58B,76C,94C,202C 'task-librari':93C,201C 'task-templ':35B 'templat':37B,59B 'templateid':173C,177C 'tenant':24B 'trace':147C 'use':121C 'user':3A,109C,185C 'withorgpermiss':117C 'without':67B,160C,216C 'yosemitecrew':1A,29B,30B,69C,88C","nicknames":[],"mitigations":[],"who_affected":"Deployments of YosemiteCrew's backend that expose the service and PMS task routes to user accounts, including patient or companion-app accounts that can register on the platform. Multi-organization deployments are most exposed, because the flaw lets one organization change another's bookings and billing data. Single-tenant setups with no outside registration have much less exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T16:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-59979","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59979","severity":null,"published_at":"2026-10-28T16:17:08+00:00","modified_at":"2026-10-28T16:17:08+00:00","first_seen_at":"2026-10-28T16:33:49+00:00","fetched_at":"2026-10-28T16:33:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}