VSee Clinic IDOR and SFTP Credential Disclosure Vulnerabilities (CVE-2026-13380/13381)

Vulnerability Overview SRA discovered multiple vulnerabilities in VSee Clinic that could lead to unauthorized file access and deletion, as well as the leakage of SFTP credentials. Affected Versions VSee Clinic from 7.1.26 to 7.1.26.1 VSee Clinic API from 1.3.0 to 1.3.0.1 Remediation Update VSee Clinic to version 7.1.26.1 or later Update VSee Clinic API to version 1.3.0.1 or later Vulnerability Details CVE-2026-13380: Insecure Direct Object Reference in File API of VSee Clinic and API allows unauthorized file access and deletion Description: VSee Clinic 7.1.26 and API 1.3.0 contain an Insecure Direct Object Reference (IDOR) vulnerability in the endpoint. An authenticated attacker can manipulate the request parameter to enumerate, retrieve, and delete files belonging to other users. CVSS Score: 8.7 (High) CVSS Vector: CVE-2026-13381: VSee Clinic and API expose plaintext SFTP credentials in unauthenticated HTTP responses Description: VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 expose plaintext SFTP credentials in HTTP responses from three unauthenticated endpoints. These credentials only appear in these responses if an SFTP connection is configured within the application. These credentials can be retrieved without authentication. Unauthenticated remote attackers can observe these HTTP responses and, on instances with SFTP configured, obtain the credentials to access the associated SFTP server. CVSS Score: 9.0 (Critical) CVSS Vector: MITRE CWE Enumeration CVE-2026-13380 - CWE-281: Insertion of Sensitive Information into Sent Data - CWE-312: Cleartext Storage of Sensitive Information CVE-2026-13381 - CWE-639: Authorization Bypass Through User-Controlled Key Credit These vulnerabilities were discovered by Chris Jones, Drew Young, and Maguire Younes as part of their research with Security Risk Advisors. Timeline June 16, 2026 - SRA submits vulnerability to vendor June 24, 2026 - Vendor releases fix July 20, 2026 - SRA publishes CVE and advisory

Goal Reached Thanks to every supporter — we hit 100%!

VSee Clinic IDOR and SFTP Credential Disclosure Vulnerabilities (CVE-2026-13380/13381)