Medium severity6.5NVD Advisory· Published May 26, 2026· Updated May 27, 2026
CVE-2026-47672
CVE-2026-47672
Description
epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. In 1.2.4 and earlier, any network-reachable caller can write arbitrary documents to any patient's electronic health record accessible by the institution's SMC-B card. In a misconfigured deployment (e.g., following the production Docker example in the README), this is exploitable from the local network without credentials.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
com.oviva.telematik:epa4all-rest-serviceMaven | <= 1.2.4 | — |
Affected products
2(expand)+ 1 more
- (no CPE)
- (no CPE)range: <=1.2.4
Patches
Vulnerability mechanics
References
4News mentions
0No linked articles in our index yet.