CVE-2026-13381 describes an authorization bypass vulnerability (CWE-639) in VSee Clinic 7.1.26 and API 1.3.0. The issue exists in the /v1.3.0/api/files endpoint where the 'remark' request parameter can be controlled by an authenticated attacker to enumerate, retrieve, and delete files of other users. This represents an Insecure Direct Object Reference (IDOR) flaw allowing unauthorized access and manipulation of user files on the application server.

An attacker with valid authentication can exploit this vulnerability to access and delete files belonging to other users, potentially leading to data loss, privacy violations, and unauthorized data disclosure. The CVSS 4.0 score of 8.7 (high severity) reflects the network attack vector with low complexity and no user interaction required, combined with high impact on confidentiality, integrity, and availability of data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoint and monitor for suspicious activity involving the 'remark' parameter. Implement additional authorization checks on the server side to ensure users can only access their own files.