The vulnerability CVE-2026-42516 in the e-Sushrut HMIS by CDAC-Noida is caused by insufficient authorization validation during resource access. Authenticated users can exploit this by altering encoded parameters in request URLs to bypass access controls and gain unauthorized access to patient accounts. This issue is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required beyond authentication, no user interaction, high impact on confidentiality, low impact on integrity, and no impact on availability. The vulnerability affects previous versions of the software, and no official fix or patch has been documented yet.

Successful exploitation allows an authenticated attacker to bypass authorization controls and access patient accounts they should not have access to, potentially exposing sensitive patient information. This compromises confidentiality of patient data within the affected HMIS. There is no indication of impact on system integrity or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider restricting access to the affected system to trusted users only and monitor for unusual access patterns. Avoid relying solely on client-side or URL parameter-based authorization controls. Implement additional server-side authorization checks where possible.