6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-47672

CVE-2026-47672: epa4all-client: Unauthenticated REST API for Patient Record Writes

epa4all-client is the Java Client for epa4all / ePA 3.0 in the Telematik Infrastruktur. In 1.2.4 and earlier, any network-reachable caller can write arbitrary documents to any patient's electronic health record accessible by the institution's SMC-B card. In a misconfigured deployment (e.g., following the production Docker example in the README), this is exploitable from the local network without credentials.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-47672

CVE-2026-47672:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.oviva.telematik:epa4all-rest-service	maven	<= 1.2.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, GHSA-c82x-f4xr-qv33, describes an unauthenticated REST API for writing patient records in the epa4all-client service. The advisory points to a pull request (#43) which only contains updates to README files, warning users about the lack of authentication and the need to secure the service in a trusted environment. This indicates the vulnerability is not a flaw in a specific line of code that was patched, but rather a fundamental design issue: the absence of authentication for critical functions.

To identify the vulnerable functions, I analyzed the service's API specification, openapi.yaml. This file defines the available REST endpoints and their corresponding operationIds, which typically map to method names in the controller code.

The openapi.yaml reveals two critical endpoints for writing data:

POST /documents with operationId: writeDocument for creating new documents.
POST /documents/{id} with operationId: replaceDocument for replacing existing documents.

These operations directly handle the writing and modification of patient health records. Since the vulnerability is the complete lack of authentication for these actions, the methods that implement these operations are the vulnerable functions. Based on standard Java project structure and the operationIds, the vulnerable functions are writeDocument and replaceDocument within the com.oviva.telematik.epa4all.rest.api.PhrDocumentsApi class. An attacker exploiting this vulnerability would directly call these endpoints, and these function names would appear in runtime profiles or stack traces.

Vulnerable functions

com.oviva.telematik.epa4all.rest.api.PhrDocumentsApi.writeDocument

epa4all-rest-service/src/main/java/com/oviva/telematik/epa4all/rest/api/PhrDocumentsApi.java

This function corresponds to the `POST /documents` endpoint, which allows writing a new document to a patient's record. According to the vulnerability description, this endpoint is unauthenticated, allowing any network-reachable caller to invoke it and write arbitrary data.

com.oviva.telematik.epa4all.rest.api.PhrDocumentsApi.replaceDocument

epa4all-rest-service/src/main/java/com/oviva/telematik/epa4all/rest/api/PhrDocumentsApi.java

This function corresponds to the `POST /documents/{id}` endpoint, which allows replacing an existing document in a patient's record. According to the vulnerability description, this endpoint is unauthenticated, allowing any network-reachable caller to invoke it and modify existing data.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.