CVE-2026-90858
Deferred Deferred - Pending Action

Authorization Bypass in Online Clinic Management System

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulDB

Description
A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Affected by this vulnerability is the function session_start of the file adminappview.php. Executing a manipulation of the argument adminmail can lead to authorization bypass. The attack may be launched remotely. The exploit has been published and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-10-05
AI Q&A
2026-09-15
EPSS Evaluated
2026-10-04
NVD
CVE-2026-90858
EUVD
EUVD-2026-78261

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
subhajitkhan online-clinic-management-system to e9ee77a8827a1446220fa07ee693dc4d9a29a578 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass flaw in the online-clinic-management-system. It affects the session_start function in adminappview.php where manipulating the adminmail argument allows unauthorized access. The issue stems from missing session validation in administrative scripts, enabling remote attackers to bypass authentication and perform sensitive actions without valid credentials.

Detection Guidance

Check for unauthorized access attempts to administrative endpoints like adminappview.php, approve.php, disadd.php, admindocview.php, and adminfeedbackview.php. Monitor network traffic for requests lacking valid session cookies targeting these files. Review server logs for unusual activity in admin-related modules.

Impact Analysis

An attacker could exploit this to access patient data, cancel appointments, approve or disable doctors, and view feedback without authorization. This could lead to privacy breaches, data manipulation, service disruptions, and potential integrity or availability issues for clinic operations and patient records.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA requirements for access controls and data protection. It enables unauthorized access to patient data, which could result in non-compliance with privacy regulations, potential legal penalties, and loss of trust in the system's ability to safeguard sensitive health information.

Mitigation Strategies

Implement centralized session validation for all administrative actions. Reject invalid or missing session cookies before allowing data access. Apply CSRF protection to state-changing requests. Ensure all admin scripts verify the $_SESSION['adminmail'] variable exists and is valid.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90858. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart