Dashboard / CVE-2026-49120

CVE-2026-49120

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 63/100
Published: 2026-06-02 Modified: 2026-11-08 First seen: 2026-11-08 Status: active

Attack Surface

Network Low Complexity No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
AT: None
VC: None
VI: Low
VA: None

Description

Medplum before 5.1.14 contains a server-side request forgery vulnerability in the subscription worker that allows authenticated users to perform unauthorized internal network requests by creating FHIR Subscription resources with arbitrary endpoint URLs. Attackers can point subscription endpoints at internal addresses such as cloud instance metadata services, internal databases, or container orchestration endpoints to exfiltrate IAM credentials and patient health records via the POST body containing full FHIR resource payloads.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
medplum medplum 0 < 5.1.14

References & Advisories (4)

Bug Bounty Relevance

63 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

6.3 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:L/SA:N

EPSS — Exploitation Probability

0.23%
Raw Score 0.002290
Percentile 13.8%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00229
2026-11-12
0.00229
2026-11-10
0.00229
2026-11-09
0.00229
2026-11-08
0.00229

Intelligence Sources

mitre ref →

External Links