A flaw exists in the detail function of laporan_data_pasien.php that allows an attacker to alter the id_param argument and bypass authorization checks. This leads to unauthorized viewing of patient records, violating confidentiality. The weakness is classified as a privilege escalation and authorization bypass (CWE‑285) and can be exploited through remotely accessed input manipulation (CWE‑639). The vulnerability can be triggered without local access and the exploit code is publicly available, meaning any entity that can reach the web application can potentially abuse it.

The product is gedelumbung HospitalManagement, with affected code up to commit c2d45543789a3887067d3915f69d44cfc2cf76a8. The project does not use a versioning scheme, so no specific release numbers are identified as fixed or susceptible.

The CVSS score of 5.1 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The exploit can be launched remotely, and public exploit scripts exist, raising the likelihood of real-world attacks. An attacker with network access to the application could easily manipulate the id_param argument to view patient data they are not authorized to see.