CVE-2026-97851

CVE-2026-97851 is a missing-authorization flaw (CWE-862) in the J4Care dcm4che storage status-change REST service. An unauthenticated remote attacker can change a storage location that is still linked to DICOM instances into a deletion-related state, including TO_DELETE. PurgeStorageScheduler then deletes the referenced object from storage while the instance record remains in the database, causing high integrity and availability impact with no confidentiality impact on the vulnerable system (CVSS 4.0 8.8). Affected version ranges are not stated in the provided data. It is not on the CISA KEV list and no public proof-of-concept is known.

What to do: Treat the storage status-change REST service as unauthenticated until patched: restrict it to trusted networks and require authentication and authorization. Upgrade dcm4che to a vendor-fixed release when J4Care or ICS-CERT publishes one; the provided data does not name a fixed version. Audit location records for unexpected deletion states such as TO_DELETE and reconcile database instance records against objects missing from storage.