CVE-2026-102846
Received Received - Intake

Authorization Bypass in gedelumbung HospitalManagement

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: VulDB

Description
A vulnerability was detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Impacted is the function sistem.php::simpan of the file application/modules/admin/controllers/sistem.php of the component Configuration Handler. The manipulation of the argument tipe/title/content_setting results in improper authorization. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-30
Last Modified
2026-09-30
Generated
2026-09-30
AI Q&A
2026-09-30
EPSS Evaluated
N/A
NVD
CVE-2026-102846
EUVD
EUVD-2026-89570

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gedelumbung hospitalmanagement to c2d45543789a3887067d3915f69d44cfc2cf76a8 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in the gedelumbung HospitalManagement system. It allows an authenticated admin to manipulate security settings through the sistem.php::simpan function by exploiting unvalidated input parameters tipe, title, and content_setting. This improper authorization issue can lead to unauthorized changes in system configuration.

Detection Guidance

Check for unauthorized changes in the application/modules/admin/controllers/sistem.php file or suspicious modifications to global variables via the tipe parameter. Inspect network traffic for unexpected redirects or phishing attempts targeting the base_url setting.

Impact Analysis

An attacker could overwrite the MD5 password salt, making all user credentials invalid and enabling credential theft. They could also change the base_url to redirect users to malicious servers for phishing attacks. Persistent stored XSS is possible by overwriting site metadata like site_title.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive patient data, violating GDPR and HIPAA compliance requirements for data protection and security. The credential theft and phishing risks further exacerbate compliance violations.

Mitigation Strategies

Immediately restrict access to the admin/sistem::simpan function, validate all input parameters strictly, and monitor for unauthorized changes to critical settings like base_url or password salt. Consider disabling the affected module if no patch is available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102846. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart