This vulnerability involves improper control of resource identifiers in the actionGetPatientById function within the HTTP REST API of medkey-org medkey. An attacker can manipulate the ID parameter to potentially access or control resources improperly. The issue affects versions up to commit fc09b7ba9441ff590b72d428d5380834216b09ed. The product's rolling release model means no discrete version numbers are provided for affected or fixed releases. The vendor has not issued any advisory or patch, and public exploit code exists. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low complexity, no privileges required, and no user interaction.

The vulnerability allows remote attackers to manipulate resource identifiers in the REST API, potentially leading to unauthorized access or control of patient data via the actionGetPatientById function. The medium CVSS score reflects a moderate risk due to the ease of exploitation and the sensitivity of the affected resource. No further impact details or exploitation consequences are provided.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. Until a patch is available, consider restricting access to the affected API endpoints and implementing additional access controls or input validation as temporary mitigations.