A low-privilege user can walk past role limits in Synapse Mobility

MedDevice Cyber Staff · Aug 21 · 3 min read · Via CISA

FUJIFILM Healthcare Americas got ICSMA-25-233-01 for its Synapse Mobility enterprise imaging viewer, versions 8.0 through 8.1.1. CVE-2025-54551, external control of an assumed-immutable web parameter. In plain terms, a logged-in user with low privileges edits a search parameter and reaches imaging and patient records their role was never supposed to show them.

The defect belongs to a broad class in which an application decides what a user may see by trusting a value the user's own client supplied. A parameter that names a record or a scope is treated as fixed once issued, yet nothing on the server stops the client from returning a different one. When the check that grants access runs only at login and not again on each request, altering that value quietly widens what the session can reach.

For an enterprise imaging viewer the records past that boundary are studies and identifiers belonging to patients the logged-in user has no clinical relationship with. A horizontal break of this shape crashes nothing and announces nothing, which makes it a compliance problem as much as a security one; access that leaves no trace can persist unnoticed.

Base score 4.3, which undersells how it feels to a compliance team. This is a horizontal access-control break, not a crash. Fixed in 8.2, with interim mitigations to disable search or uncheck the plain-text accession number option. Christopher Alejandro of Moroco reported it.

Authorization flaws of this shape rank among the most common findings in web-facing clinical software because they hide inside ordinary features. A search field, a document link or a record identifier all pass values back to the server, and each is a chance for the same mistake. They also slip past automated scanners, since the request itself looks legitimate.

Assumed-immutable is the phrase to keep. Every parameter a client sends back is one the client can change, so if your authorization only checks the front door, the search box is a side entrance.

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

FUJIFILM Synapse Mobility let an authenticated low-privilege user manipulate a web search parameter to reach imaging and patient data beyond their role (ICSMA-25-233-01). Apply the fix and enforce authorization on the server for every object a request can name.

Apply the vendor update. Install the fixed Synapse Mobility version from ICSMA-25-233-01.
Authorize every object reference. Check on the server that the logged-in user may see the specific record a parameter names, rather than trusting the role at login.
Test for IDOR directly. Include object-reference tampering in your test plan, since role checks alone miss it.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the properties below. Check them against your product to gauge exposure.

Required

data_phi

Contributing

app_web_ui app_user_accounts app_roles net_cloud net_remote_access app_database use_hospital_net parse_image

EMB3D

PID-28 PID-311 PID-34

Fix the class in your product

The login worked; the authorization did not follow through on every object the request names. As the maker, authorize every object reference on the server against the caller, return uniform responses so nothing can be enumerated, and strip internal detail from what the backend returns.

Authorize per object. Check on the server that the caller may see the specific record a request names, on every request.
Answer uniformly. Login and lookup respond identically for present and absent accounts.
Return generic errors. Log detail server-side; never leak internal state to the client.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2025-54551 in FUJIFILM Synapse Mobility?

External control of an assumed-immutable web parameter in versions 8.0 through 8.1.1, covered by ICSMA-25-233-01. A logged-in low-privilege user can edit a search parameter and reach imaging and patient records beyond their assigned role.

How is the Synapse Mobility flaw fixed?

Version 8.2 fixes it. Interim mitigations are disabling search or unchecking the plain-text accession number option. Christopher Alejandro of Moroco reported it.

← Back to Vulnerabilities