Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2026-97851

J4Care dcm4che Missing Authorization

Description

The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states. Changing a location to TO_DELETE causes PurgeStorageScheduler to delete the referenced object from storage even though the corresponding instance record remains in the database.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

J4Care dcm4chee-arc-light

Default version status: unaffected

  • 5.35.1affected
  • 5.35.2unaffected

References