PT-2026-46857 · Maven · Com.Oviva.Telematik:Epa4All-Rest-Service

Published 2026-06-04 · Updated 2026-06-04

OSV

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Impact

Any network-reachable caller can write arbitrary documents to any patient's electronic health record accessible by the institution's SMC-B card. In a misconfigured deployment (e.g., following the production Docker example in the README), this is exploitable from the local network without credentials.

Patches

• #43

Workarounds

Use network policies or proxies to enforce service-to-service authentication via e.g. mTLS.

• run the service in an isolated network namespace e.g. as Kubernetes sidecar
• service-mesh with corresponding policies

References

• MS-OVIVA-EPA4ALL-8b2af7

Credits

Machine Spirits ([e-mail])

• Dr. rer. nat. Simon Weber
• Dipl.-Inf. Volker Schönefeld
• Chiara Fliegner

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

GHSA-C82X-F4XR-QV33

Affected Products

Com.Oviva.Telematik:Epa4All-Rest-Service

References · 5

• https://osv.dev/vulnerability/GHSA-c82x-f4xr-qv33 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-47672 · Security Note
• https://github.com/oviva-ag/epa4all-client/pull/43 · Note
• https://github.com/oviva-ag/epa4all-client/security/advisories/GHSA-c82x-f4xr-qv33 · Note
• https://github.com/oviva-ag/epa4all-client · Note