CVE-2026-42515 HIGH

CVE-2026-42515: Insecure Direct Object Reference (IDOR) Vulnerability in e-Sushrut HMIS

Vendor Cdac-Noida
Product e-Sushrut, Hospital Management Information System (HMIS)
Weakness CWE-639 · IDOR
Published April 29, 2026
Last update April 29, 2026
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

This vulnerability exists in e-Sushrut due to improper access control in resource access validation. An authenticated attacker could exploit this vulnerability by manipulating parameter in the API request URL to gain unauthorized access to sensitive information of patients on the targeted system.

Key dates

02Disclosure timeline

April 29, 2026 CVE published
April 29, 2026 Record updated