CVE-2026-118795
Received
Received - Intake
Privilege Escalation in Local Database Module
Vulnerability report for CVE-2026-118795, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-09
Last updated on: 2026-11-09
Assigner: ENISA
Description
Description
Administrative roles and module permissions are stored in mutable local database fields, allowing privilege escalation for attackers with database write access.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| CompuGroup Medical | Infantia | From 0 (inc) to 6.9.1 (inc) |
| CompuGroup Medical | Profim | From 0 (inc) to 6.9.1 (inc) |
| CompuGroup Medical | Venere | From 0 (inc) to 8.33.2 (inc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-602 | The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server. |
