Insurance Management System CVE-2026-114249

Exploitation requires that the target deployment expose the /Agent/includes/UpdatePolicyHolder-inc.php endpoint of this specific dhikshitha29 Insurance-Management-System application and accept a manipulated Policy_no argument; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no special configuration, and no user interaction are needed against a default install. The practical limiting factor is not technical difficulty but deployment: this is a niche open-source PHP project that is rarely run in production, so the realistic attack surface is confined to the few instances actually hosting it. No fixed version exists (rolling releases; vendor unresponsive), so no patched configuration is available to exclude.

This is a CWE-285 improper-authorization flaw in the Policy Holder Update Form of an open-source PHP 'Insurance-Management-System' hosted on a personal GitHub account. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L, base 6.9, E:P) is internally consistent with the description: remote, network-reachable, no authentication (PR:N), no user interaction, and low-not high-impact to confidentiality, integrity, and availability, which fits an authorization bypass that exposes or alters individual policy-holder records rather than granting full system compromise. A public exploit exists (referenced GitHub issue #6), and the CVSS 4.0 exploit-maturity metric is E:P (Proof-of-Concept), so this is publicly available exploit code - NOT evidence of active exploitation. This CVE is NOT in CISA KEV, and no EPSS score was provided in the input, so real-world exploitation probability cannot be quantified from available data. The signals are consistent (network/unauthenticated with a working PoC), which raises technical exploitability, but they are offset by the product's footprint: this is an obscure hobby/student-grade project with no known enterprise deployment, VulDB is the sole reporting source, and the vendor has not responded to the early issue report. Net assessment: technically easy to exploit but very low practical priority for most organizations because the affected software is almost never deployed in production; treat as high-severity only for the rare environment that actually runs this specific project.

A remote, unauthenticated attacker sends a crafted request to /Agent/includes/UpdatePolicyHolder-inc.php and manipulates the Policy_no parameter to reference a policy holder they do not own, bypassing authorization checks to view or modify that record. A public proof-of-concept is already available via the project's GitHub issue tracker, and the CVSS metrics (AV:N/AC:L/PR:N/UI:N) indicate the attack needs no authentication, special conditions, or victim interaction.