CVE-2026-105382: onetwothreeneth HospitalManagementSystem Account Administration controller.php update_subaccount improper authorization
A flaw has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This affects the function updatesubaccount of the file php/controller.php of the component Account Administration. This manipulation of the argument userid causes improper authorization. Remote exploitation of the attack is possible. The exploit has been published and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
The issue is remotely exploitable and requires no privileges or user interaction according to the supplied severity vector. An attacker can manipulate the user_id argument handled by the Account Administration update_subaccount function.
Are fixed versions available?
No affected or updated release versions are provided because the product uses a rolling-release model. The affected code is reported as present through commit 9ef91ed6007314b6473110ed699dff76d158f61d.
Is public exploit code available?
Yes. The exploit has been published and may be used, increasing the likelihood of attempted exploitation.
Has the project addressed the report?
The project was notified early through an issue report but had not responded at the time of the provided information. No vendor fix or workaround is identified in the data.