The vulnerability CVE-2026-42515 in e-Sushrut HMIS arises from improper access control in resource validation, allowing an authenticated user to manipulate API request parameters to bypass authorization and access sensitive patient data without proper permissions. It is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). The CVSS 4.0 score is 7.1 (high severity), reflecting network attack vector, low attack complexity, no user interaction, and high impact on confidentiality. No vendor-provided patch or mitigation is currently documented, and the product is not a cloud service, so remediation is dependent on vendor action.

Successful exploitation allows an authenticated attacker to gain unauthorized access to sensitive patient information within the e-Sushrut HMIS. This compromises patient confidentiality and potentially violates privacy regulations. The vulnerability does not require user interaction and can be exploited remotely over the network with low complexity, making it a significant risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is currently available, organizations should monitor vendor communications for updates. Until a patch is released, restrict access to the affected API endpoints to trusted users only and consider additional access control measures to limit exposure.