Which versions of e-Sushrut are affected by EUVD-2026-26201?

C-DAC's e-Sushrut Hospital Management Information System (HMIS) contains an authentication bypass vulnerability (CVE-2026-42516) that allows internal staff members to access other patients' medical…

How to fix or mitigate EUVD-2026-26201?

Within 24 hours, inventory all e-Sushrut HMIS deployments in your environment and request access logs from C-DAC; coordinate with CERT-In (reference CIVN-2026-0207) to confirm your systems are in scope. Within 7 days, implement mandatory application-level access control checks ensuring each user can only access their own patient records, enable detailed audit logging of all patient record access including user ID and timestamp, and review historical logs from the past 30 days for unauthorized cross-patient access. Within 30 days, engage C-DAC for a timeline to a security patch, conduct a full authorization architecture review of the application, and perform forensic analysis of all access logs from the past 90 days to identify and remediate any unauthorized data exposure.

e-Sushrut EUVD-2026-26201

Q: What is the CVSS score of EUVD-2026-26201?

EUVD-2026-26201 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-42516 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-04-29 vdisclose@cert-in.org.in

Authentication Bypass

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.1 HIGH

Network-reachable IDOR needing only a low-privilege account (PR:L) and no interaction; high confidentiality from patient-data disclosure, minor integrity, no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 02:33 vuln.today

EUVD ID Assigned

Apr 29, 2026 - 09:22 euvd

EUVD-2026-26201

CVE Published

Apr 29, 2026 - 09:16 nvd

HIGH 7.1

DescriptionCVE.org

This vulnerability exists in e-Sushrut due to improper authorization checks during resource access. An authenticated attacker could exploit this vulnerability by manipulating encoded parameters in the request URL to gain unauthorized access to patient accounts on the targeted system.

AnalysisAI

Insecure Direct Object Reference (IDOR) in C-DAC's e-Sushrut Hospital Management Information System (HMIS) lets an authenticated attacker read other patients' records by tampering with encoded identifiers in the request URL. Any logged-in, low-privilege user (per CVSS PR:L) can pivot from their own session to arbitrary patient accounts, exposing sensitive medical data. Reported to CERT-In (CIVN-2026-0207); no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.05%).

Technical ContextAI

e-Sushrut is a hospital management information system developed by India's Centre for Development of Advanced Computing (C-DAC) and deployed across public/government healthcare facilities. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key), the classic IDOR pattern: the application uses a client-supplied, encoded identifier to select which patient resource to return but fails to verify that the authenticated session is entitled to that record. Because the parameter is merely encoded (e.g., Base64/hex/obfuscation) rather than cryptographically bound to the user's authorization context, an attacker can decode, alter or substitute the value, re-encode it, and reference records belonging to other patients. The flaw lives in the access-control layer, not in authentication itself, despite the vendor 'Authentication Bypass' tag.

RemediationAI

Apply the C-DAC-provided fixed release for e-Sushrut/HMIS as referenced in CERT-In advisory CIVN-2026-0207 (https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0207); an exact fixed version number is not present in the available data, so obtain and confirm it from C-DAC before deployment. Where immediate patching is not possible, enforce server-side authorization on every record-access endpoint so that the session identity - not the client-supplied encoded parameter - determines which patient record is returned, and replace guessable/encoded identifiers with per-user unpredictable references or an ownership check keyed to the authenticated user. As compensating controls, restrict application access to trusted networks/VPN to shrink the pool of authenticated attackers, enable detailed access logging and alert when a single account enumerates many distinct patient IDs (the primary exploitation footprint), and rate-limit record-lookup endpoints; these reduce exposure and improve detection but do not close the underlying IDOR, so they are stopgaps pending the vendor fix. See VulDB https://vuldb.com/vuln/360110 for corroborating detail.