YosemiteCrew: Missing organization authorization on service and PMS library/template routes

published 2026-06-21 4mo ago modified 2026-11-02 9d ago also EUVD-2026-112145 , GHSA-256m-gg99-4274

Unreviewed: the maintainers' own advisory

Published by the maintainers on their GitHub repository YosemiteCrew/Yosemite-Crew. GitHub has not reviewed it into the GitHub Advisory Database, so the affected packages and versions are the maintainers' word. Read the full advisory on GitHub.

cvss: 8.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 22%
public exploits: 0; none known

YosemiteCrew provides organization-based service and task management. In the source-reported affected main and dev snapshots, YosemiteCrew's service and PMS task-library/template routes omit organization and permission checks. `authorizeCognito` in `apps/backend/src/middlewares/auth.ts` sets the authenticated user's ID but does not provide the `withOrgPermissions()` and `requirePermission(...)` checks used by protected siblings. In `apps/backend/src/routers/service.router.ts`, `PATCH /fhir/v1/service/:id` and `DELETE /fhir/v1/service/:id` are authentication-only, while `GET /fhir/v1/service/:id` has no authentication middleware. The trace through `apps/backend/src/controllers/web/service.controller.ts` to `apps/backend/src/services/service.service.ts` passes a global record ID into `ServiceModel.findById(oid)` without an `organisationId` filter. In `apps/backend/src/routers/task.router.ts`, `PUT /v1/task/pms/library/:libraryId`, `POST /v1/task/pms/templates`, `PATCH /v1/task/pms/templates/:templateId` and `DELETE /v1/task/pms/templates/:templateId` likewise lack organization/role enforcement. Any registered platform user, including a patient/companion-app account, can modify or delete another organization's service catalogue and PMS task-library/template data, affecting bookings and billing; service records can additionally be read without authentication. An earlier security change protected create routes but left these sibling operations exposed. A fixed release cannot be established from the available evidence.

Is CVE-2026-59979 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 9d ago (2026-11-02)

Exploit prediction

0.30% chance of exploitation in the next 30 days, higher than 22% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by	version	score	vector
CNA	3.1	8.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

Affected products

YosemiteCrew Yosemite-Crew

Classification

Weakness

CWE-639 Authorization Bypass Through User-Controlled Key
CWE-862 Missing Authorization

References

github.com /YosemiteCrew/Yosemite-Crew/security/advisories/GHSA-256m-gg99-4274
advisory

Sources

CVE List CVE-2026-59979
NVD CVE-2026-59979
Maintainer advisory GHSA-256m-gg99-4274

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of YosemiteCrew/Yosemite-Crew published their own advisory on GitHub. Reviewed sources take precedence over it.