This vulnerability in e-plugins Hospital Doctor Directory (<= 1.3.9) involves missing authorization checks due to misconfigured access control security levels. It allows users with limited privileges to potentially perform unauthorized actions, impacting data integrity primarily, with some confidentiality and availability impact. The CVSS 3.1 base score is 7.6 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L), reflecting network attack vector, low attack complexity, and limited privileges required without user interaction. No patch or vendor advisory is currently available.

The vulnerability can lead to unauthorized modification of data (high integrity impact), limited information disclosure (low confidentiality impact), and minor availability disruption (low availability impact). Since it involves missing authorization, attackers with some privileges could escalate their capabilities or perform unauthorized actions within the Hospital Doctor Directory application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected versions and monitor for unusual activity related to privilege escalation or unauthorized access attempts. Avoid deploying or exposing vulnerable versions in production environments where possible.