This vulnerability exists in gedelumbung HospitalManagement up to commit c2d45543789a3887067d3915f69d44cfc2cf76a8. It affects the sistem.php::simpan function within application/modules/admin/controllers/sistem.php, specifically the Configuration Handler component. Improper authorization arises from manipulation of the arguments tipe, title, and content_setting, potentially allowing unauthorized remote actions. The software follows a rolling release model, so no discrete version numbers are provided for affected or patched releases. The vendor has not yet responded to the issue report. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to limited impacts on confidentiality, integrity, and availability.

The vulnerability allows remote attackers to bypass authorization controls by manipulating specific parameters in the configuration handler, potentially leading to unauthorized changes in system configuration. The impact is rated medium with limited confidentiality, integrity, and availability impacts according to the CVSS 4.0 score of 5.1. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has not responded to the issue report, and no official fix or patch links are available. Until a fix is released, cautious handling of access controls and monitoring for unauthorized configuration changes is advised.