CVE-2026-42515CWE-639

Insecure Direct Object Reference (IDOR) Vulnerability in e-Sushrut HMIS

High · published April 29, 2026

CVSS v4.0
7.1
EPSS
0%
Percentile
27.5
In the wild
Unconfirmed
What it is

This vulnerability exists in e-Sushrut due to improper access control in resource access validation. An authenticated attacker could exploit this vulnerability by manipulating parameter in the API request URL to gain unauthorized access to sensitive information of patients on the targeted system.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00351 · 27.5th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-04-29T08:22Z
EPSS history
Timeline
  • 29 APR 08:22Z
    Insecure Direct Object Reference (IDOR) Vulnerability in e-Sushrut HMIS
    cvelistv5