Vulnerability in AIS Login Routing of Compugroup Medical's Applications
CVE-2026-118458

8.1HIGH

Key Information:

Vendor

Compugroup Medical

Status
Phronesis
Venere
Vendor
CVE Published:
9 November 2026

What is CVE-2026-118458?

This vulnerability allows the AIS login routing to inadvertently select a test DAO that was shipped with the production version. The associated flaw lies in the plaintext comparison of the application codes, enabling unauthorized access through fixed administrator accounts. As a result, compromised accounts could lead to sensitive data exposure and further exploitation.

Affected Version(s)

Phronesis 0 <= 5.1.15.1.1

Venere 0 <= 5.1.15.1.1

References

https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-i...
https://www.cgm.com/ita_it/magazine/articles/comunicati-s...

CVSS V4

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marco Sala
CSIRT-IT
ApoCert srl
.