CVE-2026-105382: Improper Authorization in onetwothreeneth HospitalManagementSystem

This vulnerability in onetwothreeneth HospitalManagementSystem up to commit 9ef91ed6007314b6473110ed699dff76d158f61d allows an attacker to manipulate the user_id argument in the update_subaccount function within php/controller.php, causing improper authorization. The flaw enables remote attackers to perform unauthorized actions without privileges or user interaction. The product's rolling release approach means no explicit version numbers are given for affected or fixed releases. The issue was reported early but remains unaddressed by the vendor. Exploit code is publicly available.

An attacker can remotely exploit this vulnerability to bypass authorization controls in the Account Administration component, potentially modifying subaccount data without proper permissions. This could lead to unauthorized access or changes within the hospital management system, impacting data integrity and security. The CVSS 4.0 score of 6.9 reflects a medium severity with network attack vector, no privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should monitor for updates from the vendor. In the meantime, restrict access to the affected functionality and implement compensating controls such as network-level restrictions or additional authorization checks if possible.