The flaw resides in the UpdatePolicyHolder-inc.php script within the Policy Holder Update Form component of the Insurance‑Management‑System. By manipulating the Policy_no parameter, a remote actor can bypass authorization checks and perform actions that should be restricted to privileged users. The vulnerability is an improper authorization defect that allows unauthorized users to view or potentially alter policy holder information. Because the attack can be carried out over the network, it is considered a remote exploitation.

The affected software is the Insurance‑Management‑System developed by dhikshitha29, available at the GitHub repository. The system follows a rolling release model and publicly hosts its source code, but specific version tags for the vulnerable code have not been released. The component at /Agent/includes/UpdatePolicyHolder-inc.php is the entry point for updates to policy details. No other products or third‑party components are explicitly listed as affected.

The CVSS score of 6.9 indicates a moderate to high severity. The EPSS score is not provided, and the vulnerability has not been recorded in CISA’s KEV catalog. Attackers only need to supply a crafted request with a modified Policy_no value; no local code execution or elevation of privileges is required beyond the existing authenticated session. Because the project has yet to issue a fix, the primary risk is the potential for data tampering or unauthorized disclosure of policy holder records.