CVE-2026-114249: Improper Authorization in dhikshitha29 Insurance-Management-System

This vulnerability in dhikshitha29 Insurance-Management-System arises from improper authorization checks in the Policy Holder Update Form component, specifically in the handling of the Policy_no argument within the /Agent/includes/UpdatePolicyHolder-inc.php file. An attacker can remotely manipulate this argument to bypass authorization controls, potentially allowing unauthorized updates to policy holder information. The system's rolling release model means no discrete version numbers are provided for affected or patched releases. The vulnerability is publicly disclosed with exploit code available, but the vendor has not yet addressed the issue.

Successful exploitation allows remote attackers to bypass authorization controls and potentially modify policy holder data without proper permissions. This could lead to unauthorized data manipulation within the insurance management system. The vulnerability does not require privileges or user interaction, increasing its risk. However, the impact is rated medium severity.

No official fix or patch is currently available as the vendor has not responded to the issue report. Users should monitor the vendor's communications for updates. Until a fix is provided, restrict access to the affected component where possible and consider additional access controls or monitoring to detect unauthorized attempts. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.