Which versions of e-Sushrut are affected by EUVD-2026-26198?

C-DAC's e-Sushrut Hospital Management Information System contains an authorization flaw (CVE-2026-42515) allowing authenticated users to access other patients' medical records through parameter…

How to fix or mitigate EUVD-2026-26198?

Within 24 hours, audit all administrator and user accounts in e-Sushrut HMIS; restrict elevated system access to essential clinical and IT personnel only; enable comprehensive audit logging of all patient record access attempts. Within 7 days, deploy API-level authorization checks to validate that each user request for patient data is restricted to records the requesting user is authorized to access; establish real-time alerting for any single account accessing multiple unrelated patient records within 1-hour windows. Within 30 days, engage C-DAC for vendor security roadmap and patch timeline; implement network segmentation isolating the HMIS from general user network segments; conduct formal privacy impact assessment for any unauthorized access that may have already occurred and notify affected patients per regulatory requirements.

e-Sushrut EUVD-2026-26198

Q: What is the CVSS score of EUVD-2026-26198?

EUVD-2026-26198 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-42515 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-04-29 CERT-In

Authentication Bypass E Sushrut Hospital Management Information System Hmis Cdac Noida

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Remote low-complexity API abuse needs an authenticated account (PR:L), yields high confidentiality loss of patient data, with no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 02:33 vuln.today

CVSS changed

Apr 29, 2026 - 09:22 NVD

7.1 (HIGH)

EUVD ID Assigned

Apr 29, 2026 - 08:30 euvd

EUVD-2026-26198

CVE Published

Apr 29, 2026 - 08:22 nvd

HIGH 7.1

DescriptionCVE.org

This vulnerability exists in e-Sushrut due to improper access control in resource access validation. An authenticated attacker could exploit this vulnerability by manipulating parameter in the API request URL to gain unauthorized access to sensitive information of patients on the targeted system.

AnalysisAI

Unauthorized patient-data disclosure in C-DAC's e-Sushrut Hospital Management Information System (HMIS) allows an authenticated user to read other patients' sensitive records by tampering with an identifier parameter in an API request URL. The flaw is a classic insecure-direct-object-reference (IDOR) authorization gap reported by CERT-In (CIVN-2026-0207); there is no public exploit identified at time of analysis and EPSS estimates exploitation probability at only 0.05%, but the low attack complexity makes abuse trivial for any logged-in account.

Technical ContextAI

e-Sushrut HMIS is a hospital management platform developed by C-DAC Noida and widely used across Indian government and public-sector healthcare facilities to manage patient registration, clinical records, and administrative workflows. The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), meaning the application validates that a user is authenticated but fails to verify that the authenticated user is authorized for the specific object referenced by a request parameter. The affected CPE is cpe:2.3:a:cdac-noida:e-sushrut,_hospital_management_information_system_(hmis), and the exposed surface is a REST/HTTP API endpoint whose URL parameter (e.g., a patient or resource ID) is trusted without a per-object ownership or role check, letting an attacker enumerate or substitute IDs to reach records they should not see.

RemediationAI

Apply the fix or updated build referenced in the CERT-In advisory (CIVN-2026-0207, https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0207); a specific vendor-released patch version is not identified in the available data, so operators should contact C-DAC to obtain the patched release and confirm the exact version. Until patched, enforce server-side object-level authorization on the affected API endpoints so that every request re-checks that the authenticated user owns or is entitled to the requested patient/resource ID rather than trusting the URL parameter; where feasible, replace sequential/guessable identifiers with unpredictable tokens to blunt enumeration, and restrict API access to trusted internal networks or VPN to reduce the pool of potential authenticated attackers. As compensating monitoring, enable and review application access logs for a single account retrieving many distinct patient IDs in a short window - the trade-off is that logging alone is detective, not preventive, and access restriction may impede legitimate remote clinical users.