CVE-2026-114248: Missing Authentication in dhikshitha29 Insurance-Management-System

This vulnerability in dhikshitha29 Insurance-Management-System arises from missing authentication checks in the Plan Management Form component, specifically in the /Admin/includes/AddNewPlan-inc.php file. Attackers can remotely manipulate input parameters (submit, Plan_no, Name) to bypass authentication controls. The product uses a rolling release deployment, so no specific affected or fixed versions are identified. The issue was reported early to the project, but no vendor response or patch has been provided. The CVSS 4.0 score is 6.9, indicating medium severity with network attack vector, no privileges required, no user interaction, and low impact on integrity.

An unauthenticated remote attacker can manipulate key parameters in the Plan Management Form to bypass authentication controls, potentially allowing unauthorized access or modification of insurance plan data. The impact is limited to low integrity violation with no confidentiality or availability impact reported. The vulnerability could lead to unauthorized changes in the system's plan management functionality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should monitor official channels for updates. Until a fix is provided, restricting access to the affected component or implementing additional authentication controls at the network or application level may help mitigate risk.