CVE-2026-114249

Deferred Deferred - Pending Action

Improper Authorization in Insurance Management System via Policy_no

Publication date: 2026-10-21

Last updated on: 2026-10-27

Assigner: VulDB

Description

A vulnerability was detected in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. This vulnerability affects unknown code of the file /Agent/includes/UpdatePolicyHolder-inc.php of the component Policy Holder Update Form. The manipulation of the argument Policy_no results in improper authorization. It is possible to launch the attack remotely. The exploit is now public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-27

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-114249

EUVD

EUVD-2026-107259

Affected Vendors & Products

Vendor	Product	Version / Range
dhikshitha29	Insurance-Management-System	91de5edda5baa109ad8e9baf03ce6a3ceda84183
dhikshitha29	Insurance-Management-System	125362cc21dca20d74091a4913a5096bb58dd837

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-266	A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) flaw in the Insurance-Management-System. It allows unauthenticated attackers to modify any policy holder's personal data by manipulating the Policy_no parameter in the UpdatePolicyHolder-inc.php file. The system fails to validate user sessions or verify if the targeted policy belongs to the caller's agency, enabling arbitrary data changes.

Detection Guidance

Check for unauthorized POST requests to /Agent/includes/UpdatePolicyHolder-inc.php with the Policy_no parameter. Look for requests modifying sensitive fields like name, contact, address, or nominee details without proper session validation.
Inspect server logs for unusual activity targeting the UpdatePolicyHolder-inc.php file, especially from external IPs or without valid session tokens.
Use network monitoring tools to detect outbound requests or data exfiltration attempts that may indicate exploitation of this IDOR vulnerability.

Impact Analysis

An attacker could exploit this to overwrite sensitive policy holder details such as name, contact information, address, nominee details, and date of birth. This could lead to identity fraud, social engineering attacks, or unauthorized access to confidential data.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA requirements for data protection and access controls. It enables unauthorized modification of personal data, which could result in non-compliance with privacy regulations, potential legal penalties, and loss of trust in the system's security.

Mitigation Strategies

Immediately restrict access to the /Agent/includes/UpdatePolicyHolder-inc.php file by implementing proper authentication and authorization checks.
Validate that the Policy_no parameter belongs to the user's agency before processing any updates to prevent unauthorized modifications.
Apply input validation to ensure only expected data types and values are accepted for the Policy_no and other sensitive fields.
Monitor for any signs of exploitation and consider temporarily disabling the affected functionality until a patch is applied.

Hi! I’m here to help you understand CVE-2026-114249. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...