CVE-2026-42515
HighSummary
This vulnerability in e-Sushrut is due to improper access control in resource access validation.
Risk Assessment
An authenticated attacker can manipulate parameters in API request URLs to gain unauthorized access to sensitive patient information.
Recommendation
Strengthen server-side access control and ensure each parameter is properly validated.
Other vulnerabilities in e-Sushrut
See all- CVE-2026-42518High
This vulnerability in e-Sushrut is due to disclosure of sensitive information and hardcoded AES encryption keys in client-side JavaScript.
- CVE-2026-42517High
This vulnerability in e-Sushrut is due to the use of reversible Base64 encoding for protecting sensitive data.
- CVE-2026-42516High
This vulnerability in e-Sushrut is due to improper authorization checks during resource access.
- CVE-2026-42514High
This vulnerability in e-Sushrut is due to exposure of OTPs in plaintext within API responses.
- CVE-2026-42513High
This vulnerability in e-Sushrut is due to improper authentication logic that relies on client-side response parameters to determine authentication status.
Original NVD description (English source)
This vulnerability exists in e-Sushrut due to improper access control in resource access validation. An authenticated attacker could exploit this vulnerability by manipulating parameter in the API request URL to gain unauthorized access to sensitive information of patients on the targeted system.