Skip to content
OpenAdvisories
Critical · 9.1 CVE-2026-97851 EUVD-2026-102890

J4Care dcm4che Missing Authorization

Published Oct 16, 2026 · Updated Oct 16, 2026 · Assigned by icscert

Description

The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states. Changing a location to TO_DELETE causes PurgeStorageScheduler to delete the referenced object from storage even though the corresponding instance record remains in the database.

Affected products

VendorProductAffectedFixed
J4Care dcm4chee-arc-light 5.35.1 5.35.2

Advisories 1

References