A flaw has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. (CVE-2026-105382)

CVE-2026-105382 describes an improper authorization vulnerability in onetwothreeneth HospitalManagementSystem up to commit 9ef91ed6007314b6473110ed699dff76d158f61d. The flaw is in the update_subaccount function within php/controller.php of the Account Administration component. Manipulating the user_id argument can bypass authorization controls, enabling remote attackers to exploit this flaw. The product's rolling release approach means no discrete version numbers are provided for affected or fixed releases. The project has been notified but has not issued a fix or advisory. Exploit code has been published, but no active exploitation in the wild is currently known.

Successful exploitation could allow an unauthenticated remote attacker to perform unauthorized actions related to account administration, potentially leading to limited confidentiality, integrity, and availability impacts as indicated by the CVSS vector (C:L/I:L/A:L).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, monitor official project channels for updates. Until a fix is available, restrict access to the affected component where possible and apply compensating controls to limit exposure.