Improper Access Control in e-Sushrut by e-Sushrut Systems
CVE-2026-42515

7.1HIGH

Key Information:

Vendor

Cdac-noida

Status
E-sushrut, Hospital Management Information System (hmis)
Vendor
CVE Published:
29 April 2026

What is CVE-2026-42515?

The e-Sushrut application is susceptible to an access control vulnerability due to flaws in its resource access validation process. An authenticated attacker can exploit this vulnerability by manipulating API request parameters, allowing them to bypass security measures and access sensitive patient information stored within the system. This could lead to unauthorized data exposure and significant risks to patient privacy.

Affected Version(s)

e-Sushrut, Hospital Management Information System (HMIS) Previous versions

References

https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOT...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This vulnerability is reported by Harsh Verma
.