CVE-2026-102846: gedelumbung HospitalManagement Configuration sistem.php simpan improper authorization
A vulnerability was detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Impacted is the function sistem.php::simpan of the file application/modules/admin/controllers/sistem.php of the component Configuration Handler. The manipulation of the argument tipe/title/contentsetting results in improper authorization. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must have high privileges, but can launch the attack remotely. No user interaction is required.
What component and inputs are involved?
The affected code is the Configuration Handler's sistem.php::simpan function in application/modules/admin/controllers/sistem.php. Exploitation involves manipulating the tipe, title, or content_setting arguments.
Is a fixed release available?
No affected or updated release versions are provided because the product uses a rolling-release model. The project was notified through an issue report but had not responded at the time of publication.
How urgent is remediation?
A public exploit is available and may be used. Prioritize review of remotely accessible high-privilege administrative access and configuration-change permissions.