CVE-2025-4596 MEDIUM

CVE-2025-4596: Information disclosure via IDOR in Asseco AMDX

Vendor Asseco

Product AMDX

Weakness CWE-639 · IDOR

Published January 8, 2026

Last update January 8, 2026

View on NVD All CVEs

CVSS base score

5.3/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Asseco ADMX system is used for processing medical records. It allows logged in users to access medical files belonging to other users through manipulation of GET arguments containing document IDs. This issue has been fixed in 6.09.01.62 version of ADMX.

Key dates

02Disclosure timeline

January 8, 2026 CVE published

January 8, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-4596 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/639.html

Related vulnerabilities

04Related CVE

CVE-2025-34436 AVideo < 20.1 IDOR Arbitrary File Upload CVE-2026-34602 Chamilo LMS: IDOR in /api/course_rel_users Allows Unauthorized Enrollment of Arbitrary Users into Courses CVE-2025-5681 IDOR in Turtek Software's Eyotek CVE-2026-13549 CodeAstro Complaint Management System Report Endpoint Report.php deletereport authorization CVE-2026-22588 Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification