Advisory: VSee Clinic

Mon, 20 Jul 2026 12:00:00 +0000

Summary

SRA has identified multiple vulnerabilities in VSee Clinic that can lead to unauthorized access to and deletion of files as well as exposure of SFTP credentials.

CVE Identifiers

CVE ID	CVE Name
CVE-2026-13380	VSee Clinic and API Exposes Cleartext SFTP Credentials in Unauthenticated HTTP Responses
CVE-2026-13381	VSee Clinic and API Insecure Direct Object Reference in File API Allows Unauthorized File Access and Deletion

Vulnerability Details / Description

CVE-2026-13380: VSee Clinic and API Exposes Cleartext SFTP Credentials in Unauthenticated HTTP Responses

VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are present in these responses only when SFTP connections have been configured within the application. No authentication is required to retrieve these credentials. An unauthenticated remote attacker who observes any of these HTTP responses on an instance where SFTP is configured can obtain the credentials and use them to access the associated SFTP server.

Severity

The CVSS base score of this vulnerability has been calculated to be 9.0 (Critical)

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N

CVE-2026-13381: VSee Clinic and API Insecure Direct Object Reference in File API Allows Unauthorized File Access and Deletion

VSee Clinic 7.1.26 and API 1.3.0 contain an Insecure Direct Object Reference (IDOR) vulnerability in the /v1.3.0/api/files endpoint. An authenticated attacker can manipulate the ‘remark’ request parameter to enumerate, retrieve, and delete files belonging to other users on the application server.

Severity

The CVSS base score of this vulnerability has been calculated to be 8.7 (High)

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected Versions and Models

VSee Clinic from 7.1.26 before 7.1.26.1. VSee Clinic API from 1.3.0 before 1.3.0.1.

VSee Clinic API’s default status is uknown for CVE-2026-13380 and unaffected for CVE-2026-13381.

MITRE CWE Weakness Enumeration

CVE-2026-13380

CWE-201 Insertion of sensitive information into sent data
CWE-312 Cleartext storage of sensitive information

CVE-2026-13381

CWE-639 Authorization bypass through user-controlled key

Remediation Options

Update VSee Clinic to 7.1.26.1 or later and VSee Clinic API to 1.3.0.1 or later

Source

These vulnerabilities were discovered by Chris Jones, Drew Young, and Maguire Younes as part of research performed by Security Risk Advisors.

Timeframe

June 16, 2026 - SRA submits vulnerability to vendor
June 24, 2026 - Vendor releases fix
July 20, 2026 - SRA publishes CVEs and advisory

CVE-2026-13381 on SRA Labs | Cybersecurity Research & Innovation by Security Risk Advisors