A flaw in the Medical Management System permits an attacker to reset any user account password due to improper permission checks. The vulnerability enables unauthorized credential modification, effectively bypassing authentication controls and allowing account takeover. This weakness is classed as improper privilege management, commonly identified as CWE-284.

The affected product is the Medical Management System referenced by the identifier a81df1ce700a9662cb136b27af47f4cbde64156b. No specific vendor, product name, or version information is provided in the available data, so it is unclear which builds or deployments are impacted.

The CVSS score of 6.5 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA KEV, but the potential for critical impact is clear: an attacker who can trigger password resets can immediately assume control of any user account. The likely attack vector is via the password reset interface or API, which I infer is exposed over the network or through an application layer. Since the vulnerability hinges on insecure permissions rather than an external exploit code, it is presumed easier to exploit than code‑execution flaws, though the exact exploitation likelihood remains undetermined.