A vulnerability was detected in dhikshitha29 Insurance-Management-System… (CVE-2026-114249)

The dhikshitha29 Insurance-Management-System contains an authorization vulnerability in the Policy Holder Update Form component. The vulnerability arises from improper authorization checks on the Policy_no argument in the /Agent/includes/UpdatePolicyHolder-inc.php file. This flaw allows remote attackers to manipulate the argument to bypass authorization controls. The vulnerability is publicly known and exploitable, with a CVSS 3.1 base score of 7.3, indicating a medium severity impact on confidentiality, integrity, and availability. Due to the project's rolling release model, no specific affected or fixed versions are identified. The vendor has been notified but has not yet responded or issued a fix.

Successful exploitation can lead to unauthorized access or modification of policy holder information, impacting confidentiality, integrity, and availability of the system. The vulnerability is remotely exploitable without authentication, increasing risk. However, no known active exploitation in the wild has been reported.

No official fix or patch is currently available as the vendor has not responded to the issue report. Since the project uses rolling releases, monitor the vendor's updates for any forthcoming remediation. Until a fix is provided, restrict access to the affected component where possible and apply compensating controls to limit unauthorized access to the Policy Holder Update Form.