CVE-2026-102844: HospitalManagement Auth Bypass Vulnerability

CVE-2026-102844 Overview

CVE-2026-102844 is an authorization bypass vulnerability in the gedelumbung HospitalManagement application. The flaw resides in the detail function of application/modules/admin/controllers/laporan_data_pasien.php. An attacker can manipulate the id_param argument to bypass authorization checks and access patient report data. The vulnerability is remotely exploitable and requires high privileges to abuse. A public exploit reference exists via VulDB. The affected project does not use versioning, so specific fixed or vulnerable releases cannot be enumerated. The maintainer was notified via a GitHub issue but has not responded.

Critical Impact

Authenticated attackers can bypass authorization controls on the patient report endpoint and access records outside their intended scope.

Affected Products

• gedelumbung HospitalManagement (repository state up to commit c2d45543789a3887067d3915f69d44cfc2cf76a8)
• File: application/modules/admin/controllers/laporan_data_pasien.php
• Function: detail with parameter id_param

Discovery Timeline

• 2026-09-30 - CVE-2026-102844 published to the National Vulnerability Database (NVD)
• 2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-102844

Vulnerability Analysis

The vulnerability is classified under CWE-285: Improper Authorization. The affected controller laporan_data_pasien.php (patient data report) exposes a detail action that accepts an id_param value. The controller does not adequately verify whether the authenticated user is permitted to view the record referenced by id_param. As a result, an attacker with valid low-tier admin credentials can enumerate or directly request identifiers belonging to other tenants or scopes. The exploit vector is network-based over HTTP, and no user interaction is required beyond the attacker's own request.

Root Cause

The root cause is missing or insufficient authorization enforcement in the detail handler. The application trusts the id_param value supplied by the client without cross-checking the requesting user's ownership or role against the target record. This is a classic broken access control pattern where authentication is present but authorization is not evaluated on the object being retrieved.

Attack Vector

An authenticated attacker sends a crafted HTTP request to the laporan_data_pasien/detail endpoint with a modified id_param value referencing patient records outside the attacker's scope. The server returns the requested data without validating access rights. Because the application does not use versioning, all deployments derived from the affected commit are potentially exposed.

No verified proof-of-concept code is published in the referenced sources. See the VulDB CVE-2026-102844 entry and GitHub Issue #10 for further technical detail.

Detection Methods for CVE-2026-102844

Indicators of Compromise

• Unexpected HTTP requests to /admin/laporan_data_pasien/detail/ with sequential or unfamiliar id_param values.
• Access log entries showing a single authenticated session retrieving patient detail records across many unrelated identifiers.
• Application logs indicating successful detail lookups without a preceding permission-check event.

Detection Strategies

• Instrument the detail handler in laporan_data_pasien.php to log the authenticated user identity, submitted id_param, and the record owner returned.
• Compare user role and scope against the record's owning entity for every detail request and alert on mismatches.
• Deploy a web application firewall (WAF) rule to flag high-rate enumeration of the id_param parameter from a single session.

Monitoring Recommendations

• Monitor authenticated user sessions for anomalous volume of patient record lookups outside historical baselines.
• Correlate database SELECT activity on the patient reports table with front-end authorization decisions to surface bypass attempts.
• Retain HTTP access logs and application audit trails for the admin module to support post-incident review.

How to Mitigate CVE-2026-102844

Immediate Actions Required

• Restrict access to the /admin/laporan_data_pasien/ route to trusted networks or VPN-only reachability until a code fix is applied.
• Review and reduce the number of accounts with admin-tier privileges on the HospitalManagement deployment.
• Enable verbose audit logging on the affected controller to capture ongoing exploitation attempts.

Patch Information

No vendor patch is available. The maintainer was informed via GitHub Issue #10 but has not responded. Operators should apply a local patch that validates ownership and role scope against the record referenced by id_param inside the detail function before returning data. Track upstream activity on the gedelumbung HospitalManagement repository for any future fix.

Workarounds

• Add a server-side authorization check in detail that verifies the current session's user or role owns or is entitled to the requested record.
• Replace direct object references in id_param with per-session indirect references (e.g., mapped tokens) to prevent enumeration.
• Front the application with a reverse proxy that enforces per-user rate limits on the admin report endpoints.
• If the admin module is not required, disable the admin module route in the framework configuration.

# Configuration example: restrict admin path at the reverse proxy (nginx)
location /admin/laporan_data_pasien/ {
    allow 10.0.0.0/8;         # internal admin network
    deny  all;
    proxy_pass http://hospitalmanagement_backend;
}