CVE-2025-15567: Information Disclosure in Health Module

The Information Disclosure vulnerability in the Health Module allows an attacker to potentially access sensitive data. While the description specifies 'partial information disclosure,' the exact nature of the data exposed is not detailed. Depending on the data handled by the Health Module, this could range from benign metadata to personally identifiable information (PII) or even health-related data. The impact is amplified if the module is integrated with other systems, as the attacker could potentially leverage the disclosed information for further attacks, such as identity theft or social engineering. The blast radius depends entirely on the data the module processes and stores.

1. Reserved2026-02-06
2. Published2026-02-27
3. EPSS updated2026-03-23

The primary mitigation for CVE-2025-15567 is to upgrade the Health Module to version 5.3.0.0 or later. If upgrading immediately is not feasible, consider implementing temporary workarounds to limit data exposure. This might involve restricting access to the Health Module's data, implementing stricter input validation, or disabling potentially vulnerable features. Monitor logs for any unusual access patterns or data exfiltration attempts. After upgrading, confirm the fix by verifying that the module no longer exposes sensitive information through the previously vulnerable pathways.