EUVD-2026-26203Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable IDOR requires a valid low-privilege account (PR:L) with trivial parameter manipulation (AC:L); impact is confidentiality-only (C:H, I:N, A:N), scope unchanged.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
This vulnerability exists in e-Sushrut due to the use of reversible Base64 encoding for protecting sensitive data. An authenticated attacker could exploit this vulnerability by decoding and manipulating Base64-encoded parameters in the request URL to gain unauthorized access to sensitive information on the targeted system.
AnalysisAI
Sensitive information disclosure in C-DAC's e-Sushrut Hospital Management Information System (HMIS) allows an authenticated attacker to access data belonging to other users by decoding and tampering with Base64-encoded parameters carried in request URLs. Because Base64 is a reversible encoding rather than a cryptographic control, a low-privileged logged-in user can enumerate or alter these object references (CWE-639) to reach records they are not authorized to view. This was reported by CERT-In (CIVN-2026-0207); there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.05%).
Technical ContextAI
e-Sushrut is a hospital management information system developed by C-DAC and widely deployed across Indian government and public-sector healthcare facilities to manage patient, clinical, and administrative records. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key, commonly known as IDOR): the application encodes sensitive request parameters with Base64 and treats that encoding as a protection mechanism. Base64 is a trivially reversible transport encoding, not encryption or an integrity control, so an attacker who Base64-decodes a parameter, changes the embedded identifier or value, and re-encodes it can point the request at another user's object. The absence of a server-side authorization check tied to the authenticated session - combined with client-controllable object keys - is what permits horizontal (and potentially vertical) access to sensitive information.
RemediationAI
No vendor-released patch version was identified in the available data; consult the CERT-In advisory CIVN-2026-0207 (https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0207) and contact C-DAC to obtain the fixed e-Sushrut build and apply it as the primary remediation once available. Because the flaw is a broken-object-level-authorization/IDOR issue, the durable fix is server-side: enforce per-request authorization that binds every object reference to the authenticated session and replace the Base64-'protected' identifiers with unpredictable, server-validated tokens (do not rely on encoding for access control). As interim compensating controls, restrict e-Sushrut access to trusted internal networks/VPN to shrink the authenticated attacker pool (trade-off: may hinder legitimate remote clinicians), enable detailed access logging and alert on users retrieving records outside their normal patient/department scope (trade-off: detective, not preventive), and consider a WAF/reverse-proxy rule to inspect and reject manipulated encoded parameters (trade-off: brittle and easily bypassed, so treat as stopgap only). Verify any advisory-supplied fix version before deployment rather than assuming an unlisted release resolves it.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today