Hospital Management System CVE-2026-104638

Exploitation requires network reachability to a deployed HospitalManagementSystem instance and the ability to send requests to php/sessions.php with a manipulated ID argument; no authentication (PR:N) and no user interaction (UI:N) are needed, so any internet-exposed instance running code up to commit 9ef91ed6007314b6473110ed699dff76d158f61d is reachable. The practical limiter is not configuration but deployment: this is a niche open-source project unlikely to be exposed at scale, no patched release exists (rolling release, unresponsive maintainer), and the disclosed impact is limited to confidentiality (VC:L) rather than full account takeover or data modification.

This is a medium-severity authentication flaw (CVSS 4.0 base 5.5) in a hobbyist GitHub hospital-management PHP application, and the signals point to a low real-world priority despite the network-exploitable vector. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remote, low-complexity, unauthenticated attack requiring no user interaction, but impact is constrained to low confidentiality only (VC:L, VI:N, VA:N) - no integrity or availability effect is claimed, which caps the severity. Exploit maturity is Proof-of-Concept (E:P), consistent with the description's statement that an exploit has been publicly disclosed; this is POC availability, not confirmed active exploitation. There is no CISA KEV listing and no EPSS score in the provided data, so widespread or targeted exploitation cannot be asserted. The dominant mitigating factor is prevalence: this is an obscure, single-author rolling-release project with no meaningful enterprise footprint, and the vendor has not responded to the issue report, so no patch version exists. Net assessment: a genuine unauthenticated auth weakness, but low operational priority for most defenders because of the product's rarity and the limited (confidentiality-only) impact. Note the conflict between CWE-287 'improper authentication' (which often implies an auth bypass with broader impact) and the assigned VC:L/VI:N/VA:N vector - verify the true impact against the source advisory.

A remote, unauthenticated attacker manipulates the ID argument handled by php/sessions.php to subvert the application's authentication logic and gain access to session or account context they should not have. Because a proof-of-concept has been publicly disclosed, an attacker can reproduce the technique directly; the low attack complexity and absence of required user interaction make the request trivial to send against an exposed instance.