CVE-2026-13381 describes an authorization bypass vulnerability in VSee Clinic version 7.1.26 and its API 1.3.0. The vulnerability exists in the /v1.3.0/api/files endpoint, where the 'remark' parameter can be manipulated by an authenticated attacker to perform unauthorized enumeration, access, and deletion of files belonging to other users. This is an Insecure Direct Object Reference (IDOR) vulnerability classified under CWE-639. The vulnerability has a CVSS 4.0 base score of 8.7, reflecting high severity with network attack vector, low attack complexity, no privileges required beyond authentication, no user interaction needed, and high impact on confidentiality, integrity, and availability.

An authenticated attacker can bypass authorization controls to enumerate, access, and delete files belonging to other users via the vulnerable API endpoint. This compromises confidentiality, integrity, and availability of user files within VSee Clinic version 7.1.26 and API 1.3.0. The high CVSS score reflects the significant risk posed by this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected API endpoint to trusted users only and monitor for suspicious activity involving file operations. Avoid exposing the vulnerable API endpoint to untrusted networks.