VSee vulnerabilities
We track 2 vulnerabilities in VSee products across 2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on July 20, 2026.
2vulnerabilities
0critical
2high
0exploited
7.8average CVSS score
Latest VSee vulnerabilities
- 8.1 High severity
Clinic: Authorization Bypass Through User-Controlled Key
VSee Clinic 7.1.26 and API 1.3.0 contain an Insecure Direct Object Reference (IDOR) vulnerability in the /v1.3.0/api/files endpoint. An authenticated attacker can manipulate the 'remark' request parameter to enumerate, retrieve, and delete files belonging to o
- 7.5 High severity
Clinic: Insertion of Sensitive Information Into Sent Data
VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are present in these responses only when SFTP connections have been configured within the application. No