Improper Authorization in gedelumbung HospitalManagement Configuration Handler
CVE-2026-102846

5.1MEDIUM

Key Information:

Vendor: Gedelumbung
Status: Hospitalmanagement
Vendor: CVE Published:; 30 September 2026

🔔 Create Gedelumbung Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-102846?

A vulnerability has been identified in gedelumbung HospitalManagement that allows for improper authorization via the Configuration Handler. The issue lies within the function sistem.php::simpan, where manipulation of the arguments such as tipe, title, and content_setting can allow unauthorized access. This security flaw may be exploited remotely, making it a significant concern for users. Despite early notification through an issue report, there has been no response from the project team, and the exploit is publicly known. Given that this product operates on a rolling release basis, specifics on affected versions are not available.

Affected Version(s)

HospitalManagement c2d45543789a3887067d3915f69d44cfc2cf76a8

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-102846 - Proof of Concept