CVE-2026-59979

YosemiteCrew provides organization-based service and task management. In the source-reported affected main and dev snapshots, YosemiteCrew's service and PMS task-library/template routes omit organization and permission checks. `authorizeCognito` in `apps/backend/src/middlewares/auth.ts` sets the authenticated user's ID but does not provide the `withOrgPermissions()` and `requirePermission(...)` checks used by protected siblings. In `apps/backend/src/routers/service.router.ts`, `PATCH /fhir/v1/service/:id` and `DELETE /fhir/v1/service/:id` are authentication-only, while `GET /fhir/v1/service/:id` has no authentication middleware. The trace through `apps/backend/src/controllers/web/service.controller.ts` to `apps/backend/src/services/service.service.ts` passes a global record ID into `ServiceModel.findById(oid)` without an `organisationId` filter. In `apps/backend/src/routers/task.router.ts`, `PUT /v1/task/pms/library/:libraryId`, `POST /v1/task/pms/templates`, `PATCH /v1/task/pms/templates/:templateId` and `DELETE /v1/task/pms/templates/:templateId` likewise lack organization/role enforcement. Any registered platform user, including a patient/companion-app account, can modify or delete another organization's service catalogue and PMS task-library/template data, affecting bookings and billing; service records can additionally be read without authentication. An earlier security change protected create routes but left these sibling operations exposed. A fixed release cannot be established from the available evidence.

• CWE-639
• CWE-862

• https://github.com/YosemiteCrew/Yosemite-Crew/security/advisories/GHSA-256m-gg99-4274

Published

Oct 28, 2026

Last Modified

Oct 29, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-59971MySQL MCP Server is a Model Context Protocol server that ena…10
• CVE-2026-59973FrontMCP is a TypeScript-first framework for the Model Conte…8.5
• CVE-2026-59974Stanza is a Stanford NLP Python library for tokenization, se…7.8
• CVE-2026-59976ConvertX is a self-hosted file conversion service. Prior to …8.1
• CVE-2026-59977ConvertX is a self-hosted file conversion service. Prior to …8.1
• CVE-2026-59978AdminNeo is a full-featured database management tool written…7.5
• CVE-2026-5998A flaw has been found in zhayujie chatgpt-on-wechat CowAgent…5.3
• CVE-2026-59980hpack is an HTTP/2 Header Encoding for Python. Prior to vers…6.3
• CVE-2026-59981OpenEXR is the reference implementation and specification fo…7.1
• CVE-2026-59982OpenEXR is the reference implementation and specification fo…7.1
• CVE-2026-59983OpenEXR is the reference implementation and specification fo…5.5
• CVE-2026-59984OpenEXR is the reference implementation and specification fo…5.5