Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-59979— YosemiteCrew: Missing organization authorization on service and PMS library/template routes

Quick assessment

Affected
YosemiteCrew Yosemite-Crew
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

YosemiteCrew 提供基于组织的服务与任务管理功能。在源报告中提及的受影响的主版本（main）和开发快照（dev）中，YosemiteCrew 的服务路由以及 PMS（实践管理系统）任务库/模板路由均缺失了组织归属与权限检查。 中的 函数仅设置了已认证用户的 ID，但未像受保护的兄弟路由那样调用 和 进行权限验证。 在 中， 和 仅进行了身份认证（authentication-only），而 甚至未设置任何身份认证中间件。通过 追踪至 的逻辑中，系统将全局记录 ID 直接传入 ，却未添加 过滤条件。 同样地

CVSS 8.3 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
YosemiteCrew Yosemite-Crew <= bc1a1824b1a7eba2bc61176cdb61d9a2a11bce57 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-59979

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
YosemiteCrew: Missing organization authorization on service and PMS library/template routes
Source: CVE Program / CVE List V5
Vulnerability Description
YosemiteCrew provides organization-based service and task management. In the source-reported affected main and dev snapshots, YosemiteCrew's service and PMS task-library/template routes omit organization and permission checks. `authorizeCognito` in `apps/backend/src/middlewares/auth.ts` sets the authenticated user's ID but does not provide the `withOrgPermissions()` and `requirePermission(...)` checks used by protected siblings. In `apps/backend/src/routers/service.router.ts`, `PATCH /fhir/v1/service/:id` and `DELETE /fhir/v1/service/:id` are authentication-only, while `GET /fhir/v1/service/:id` has no authentication middleware. The trace through `apps/backend/src/controllers/web/service.controller.ts` to `apps/backend/src/services/service.service.ts` passes a global record ID into `ServiceModel.findById(oid)` without an `organisationId` filter. In `apps/backend/src/routers/task.router.ts`, `PUT /v1/task/pms/library/:libraryId`, `POST /v1/task/pms/templates`, `PATCH /v1/task/pms/templates/:templateId` and `DELETE /v1/task/pms/templates/:templateId` likewise lack organization/role enforcement. Any registered platform user, including a patient/companion-app account, can modify or delete another organization's service catalogue and PMS task-library/template data, affecting bookings and billing; service records can additionally be read without authentication. An earlier security change protected create routes but left these sibling operations exposed. A fixed release cannot be established from the available evidence.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
YosemiteCrew Yosemite-Crew <= bc1a1824b1a7eba2bc61176cdb61d9a2a11bce57 -

II. Public POCs for CVE-2026-59979

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-59979

请登录查看更多情报信息。

Other References for CVE-2026-59979 (1)

IV. Related Vulnerabilities

Same weakness: CWE-639