CVE-2026-97851: dcm4chee-arc-light Storage API Lets Attackers Purge Medical Images Without Authorization

Overview

J4Care's dcm4chee-arc-light DICOM archive carries a second critical flaw disclosed alongside CVE-2026-105279: a storage status-change REST service that allows location records still tied to active DICOM instances to be flipped into deletion-related states — without verifying the caller is authorized to retire that storage location. Tracked as CVE-2026-97851, it carries a CVSS v3.1 score of 9.1 (rated 8.8 High under CVSS v4), and its practical effect is as damaging as it is quiet: medical images disappear from storage while the archive's database continues to report that they exist.

Technical Details

How It Works

dcm4chee-arc-light exposes a REST endpoint that changes the status of a storage location record — the pointer that tells the archive where a given DICOM object physically lives on disk or in object storage. The service accepts a status transition to TO_DELETE on a location even while that location is still referenced by a live DICOM instance record in the database, and without confirming the caller has rights to retire that storage location.

Once a location is marked TO_DELETE, the archive's background PurgeStorageScheduler job picks it up and deletes the underlying stored object — the actual image file — even though the corresponding instance metadata row remains in the database. The result is a desynchronized archive: the system of record says the study exists and is retrievable, but the bytes behind it are gone.

Impact Assessment

Unlike a straightforward "attacker deletes your data" bug, this flaw creates a state mismatch that can go unnoticed until someone actually tries to retrieve the affected study — at which point retrieval fails against an archive that has no indication anything is wrong. In a clinical setting, that means a referring physician or radiologist may only discover a missing image at the point of care.

Who Is At Risk

Any dcm4chee-arc-light deployment ≤ 5.35.1 with its REST API reachable by an untrusted caller, including:

• Instances where the storage status-change endpoint is exposed on the same interface as other administrative or integration APIs
• Multi-tenant or multi-facility deployments where network segmentation between sites is incomplete
• Archives without independent backup/replication of underlying image storage, where this becomes the sole copy

Potential Attack Chains

1. Target Identification — Attacker identifies DICOM instances of interest via the archive's REST API or a related flaw such as CVE-2026-105279's unauthenticated C-FIND access
2. Location Targeting — Attacker calls the storage status-change service to set the associated location(s) to TO_DELETE
3. Scheduled Destruction — PurgeStorageScheduler runs on its normal cycle and deletes the underlying image data
4. Silent Failure — The instance record persists in the database, so the archive continues to report the study as present until a retrieval attempt fails

Beyond deliberate sabotage, this also functions as a disruptive denial-of-service primitive against clinical imaging availability, and — in environments without offline backups of image storage — as an irrecoverable data-loss vector.

Mitigation

Immediate Actions

• Upgrade to dcm4chee-arc-light 5.35.2 or later, which adds authorization checks before honoring storage status transitions
• Restrict network access to the archive's REST management API to trusted administrative and integration hosts only
• Verify independent backups exist for underlying DICOM storage (separate from the archive's own database) so a purge event is recoverable
• Review PurgeStorageScheduler logs for deletion events that don't correlate with legitimate retention or lifecycle policies

Detection Opportunities

• Alert on storage location status transitions to TO_DELETE that originate outside expected retention/lifecycle automation
• Cross-check instance records against actual object storage presence periodically to catch metadata/data drift early, rather than waiting for a failed retrieval
• Monitor REST API access logs for unauthenticated or unexpected callers hitting storage management endpoints

Defence-in-Depth

• Apply least-privilege network rules so that only the archive's own internal lifecycle jobs — not external callers — can reach storage status-change endpoints
• Treat PACS/VNA storage management APIs as sensitive infrastructure requiring the same access controls as the underlying patient database
• Periodically test restore procedures for purged/archived studies to confirm backups are actually usable, not just present

Discovery & Disclosure

CVE-2026-97851 was disclosed as part of CISA's ICSMA-26-288-02 advisory covering six dcm4chee-arc-light vulnerabilities, all addressed in the 5.35.2 release. As of publication, it is not listed in the CISA KEV catalog and no public exploit has been observed, but the combination of zero authentication and irrecoverable data-loss impact makes prompt patching and backup verification a priority for any healthcare organization running this archive.

References

• CISA — ICS Medical Advisory ICSMA-26-288-02: J4Care dcm4che
• VulDB — CVE-2026-97851: dcm4chee-arc-light Storage Status-Change REST Service
• Strix — CVE-2026-97851: dcm4chee-arc-light Missing Authorization