high7.5
CVE-2026-105667
In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application.
Impact
In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another. The archive's unmerge does not reverse this.
Affected packages
This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.