High severity8.1NVD Advisory· Published Jul 20, 2026· Updated Aug 14, 2026
CVE-2026-13381
CVE-2026-13381
Description
VSee Clinic 7.1.26 and API 1.3.0 contain an Insecure Direct Object Reference (IDOR) vulnerability in the /v1.3.0/api/files endpoint. An authenticated attacker can manipulate the 'remark' request parameter to enumerate, retrieve, and delete files belonging to other users on the application server.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- cpe:2.3:a:vsee:clinic_api:1.3.0:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
2- labs.sra.io/posts/vseeclinicnvdThird Party Advisory
- vsee.com/clinicnvdProduct
News mentions
1- ⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and MoreThe Hacker News · Sep 7, 2026