CVE-2026-97851: CWE-862 in J4Care dcm4chee-arc-light

This vulnerability (CVE-2026-97851) in dcm4chee-arc-light version 5.35.1 involves improper authorization (CWE-862) in the storage status-change REST service. It permits changing location records still linked to DICOM instances to deletion states such as TO_DELETE. When this occurs, the PurgeStorageScheduler deletes the referenced object from storage, but the instance record in the database is not removed, causing a mismatch between stored data and database records. The CVSS 3.1 score is 9.1 (critical), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, but high integrity and availability impacts.

The vulnerability can cause deletion of storage objects while leaving their database instance records intact, resulting in data inconsistency and potential disruption of medical imaging workflows. This may lead to loss of availability and integrity of DICOM data managed by the affected system.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the storage status-change REST service to trusted users and monitor for unauthorized status changes to prevent exploitation.