CVE-2026-42515

HIGH

Insecure Direct Object Reference (IDOR) Vulnerability in e-Sushrut HMIS

Title source: cna

Description

This vulnerability exists in e-Sushrut due to improper access control in resource access validation. An authenticated attacker could exploit this vulnerability by manipulating parameter in the API request URL to gain unauthorized access to sensitive information of patients on the targeted system.

References (1)

[Third Party Advisory] https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0207

Scores

CVSS v4 7.1

EPSS 0.0005

EPSS Percentile 13.9%

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-639

Status published

Products (1)

CDAC-Noida/e-Sushrut, Hospital Management Information System (HMIS) Previous versions

Published Apr 29, 2026

Tracked Since Apr 29, 2026