This vulnerability (CWE-552) in Agito Computer Health4All arises from improperly configured access control settings that expose files or directories to unauthorized external access. It enables exploitation of authentication mechanisms to gain unauthorized access to sensitive data. The CVSS 3.1 base score is 8.3, reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, and high impact on confidentiality and integrity with low impact on availability. The issue affects versions before 10.01.2025. No known exploits are reported in the wild, and no patch or official remediation level has been disclosed.

Successful exploitation could lead to unauthorized disclosure and modification of sensitive information within the Health4All system, potentially compromising patient or operational data confidentiality and integrity. The availability impact is low, indicating limited disruption to system operations. The vulnerability requires an attacker to have some level of privileges but no user interaction is needed to exploit it remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review and tighten access control configurations to ensure files and directories are not accessible to unauthorized external parties. Limit privileges to the minimum necessary and monitor for unusual access patterns related to file and directory access. Follow vendor updates closely for any forthcoming patches or official mitigation instructions.