This vulnerability involves improper control of resource identifiers in the actionGetPatientById function within the PatientController.php file of medkey's HTTP REST API. Manipulating the ID parameter can lead to unauthorized access or manipulation of patient data resources. The vulnerability is remotely exploitable without authentication or user interaction. The product's rolling release model prevents clear versioning of affected or fixed releases. No vendor response or patch information is currently available. The CVSS 4.0 base score is 5.3, indicating medium severity.

An attacker can remotely manipulate the ID argument in the affected API function to improperly control resource identifiers, potentially leading to unauthorized access or exposure of patient data. The vulnerability does not require privileges or user interaction, increasing the risk of exploitation. However, no known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor for vendor updates and consider implementing access controls or input validation as interim mitigations if feasible.