---
id: "CVE-2026-59979"
kind: "vulnerability"
aliases: ["CVE-2026-59979"]
title: "YosemiteCrew: any user can edit or delete other organizations' service and task data"
severity: "high"
cvss: 8.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["billing", "healthcare", "multi-tenant", "package", "self-hosted", "yosemitecrew"]
not_affected_if: ["registration-disabled", "single-organization"]
published_at: "2026-10-28T16:17:08+00:00"
first_seen_at: "2026-10-28T16:33:49+00:00"
updated_at: "2026-10-28T16:35:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59979", "first_seen_at": "2026-10-28T16:33:49+00:00"}]
---

# YosemiteCrew: any user can edit or delete other organizations' service and task data

YosemiteCrew's service and PMS task-template routes skip organization and permission checks, so any registered account can modify or delete another organization's service catalogue and task templates. Some service records can also be read without logging in.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the deployment runs YosemiteCrew backend from the affected main or dev snapshots (`apps/backend/src/middlewares/auth.ts` lacks `withOrgPermissions()` and `requirePermission(...)` on the service and task routes)
- Confirm whether `GET /fhir/v1/service/:id` answers without an Authorization header
- unknown for a definitive version check: the sources do not give a fixed release

## Fix

- Move to a YosemiteCrew release that adds organization and permission checks to `PATCH` and `DELETE /fhir/v1/service/:id`, `GET /fhir/v1/service/:id` and the `/v1/task/pms/` library and template routes
- unknown for a fixed version: the sources say a fixed release cannot be established
- Until patched, restrict access to the backend API to trusted users only

## Timeline

- 2026-10-28T16:33:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-59979

## From the sources

YosemiteCrew provides organization-based service and task management. In the source-reported affected main and dev snapshots, YosemiteCrew's service and PMS task-library/template routes omit organization and permission checks. `authorizeCognito` in `apps/backend/src/middlewares/auth.ts` sets the authenticated user's ID but does not provide the `withOrgPermissions()` and `requirePermission(...)` checks used by protected siblings. In `apps/backend/src/routers/service.router.ts`, `PATCH /fhir/v1/service/:id` and `DELETE /fhir/v1/service/:id` are authentication-only, while `GET /fhir/v1/service/:id` has no authentication middleware. The trace through `apps/backend/src/controllers/web/service.controller.ts` to `apps/backend/src/services/service.service.ts` passes a global record ID into `ServiceModel.findById(oid)` without an `organisationId` filter. In `apps/backend/src/routers/task.router.ts`, `PUT /v1/task/pms/library/:libraryId`, `POST /v1/task/pms/templates`, `PATCH /v1/task/pms/templates/:templateId` and `DELETE /v1/task/pms/templates/:templateId` likewise lack organization/role enforcement. Any registered platform user, including a patient/companion-app account, can modify or delete another organization's service catalogue and PMS task-library/template data, affecting bookings and billing; service records can additionally be read without authentication. An earlier security change protected create routes but left these sibling operations exposed. A fixed release cannot be established from the available evidence.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_