Clinic API vulnerabilities

2 known vulnerabilities in Clinic API from VSee. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  Clinic: Authorization Bypass Through User-Controlled Key

  CVE-2026-13381Jul 20, 2026VSee

  VSee Clinic 7.1.26 and API 1.3.0 contain an Insecure Direct Object Reference (IDOR) vulnerability in the /v1.3.0/api/files endpoint. An authenticated attacker can manipulate the 'remark' request parameter to enumerate, retrieve, and delete files belonging to o

• 7.5 High severity

  Clinic: Insertion of Sensitive Information Into Sent Data

  CVE-2026-13380Jul 20, 2026VSee

  VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are present in these responses only when SFTP connections have been configured within the application. No